d00rt@d00rt-ThinkPad-X380-Yoga:~/blog/emotet_network_protocol/emutet$ nordvpn d && nordvpn c Israel You are not connected to NordVPN. Connecting to Israel #17 (il17.nordvpn.com) You are connected to Israel #17 (il17.nordvpn.com)! d00rt@d00rt-ThinkPad-X380-Yoga:~/blog/emotet_network_protocol/emutet$ python emutet.py -T --cape 4102 [+] https://www.capesandbox.com/configdownload/4102/Emotet/ === 86.22.221.170:80 === === 187.144.61.73:443 === === 185.94.252.13:443 === [+] Downloaded 3 modules [+] Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows ID: 576 Action: 3 SHA1: c116b91f030a3fdb5d8604a3492292728dfb0104 [+] Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows ID: 808 Action: 3 SHA1: 4efade384240843c8e20e0fd71d66e944d65ceb1 [+] Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows ID: 1192 Action: 3 SHA1: 469d600051c5db3812dc73e4824989ce4d5220ac d00rt@d00rt-ThinkPad-X380-Yoga:~/blog/emotet_network_protocol/emutet$ tree output/ output/ └── 20191019 └── 6bb1228864d20cdcc49b ├── 1192 │ └── 3 │ └── 469d600051c5db3812dc73e4824989ce4d5220ac ├── 576 │ └── 3 │ └── c116b91f030a3fdb5d8604a3492292728dfb0104 └── 808 └── 3 └── 4efade384240843c8e20e0fd71d66e944d65ceb1 8 directories, 3 files d00rt@d00rt-ThinkPad-X380-Yoga:~/blog/emotet_network_protocol/emutet$ exit exit