Edit tour

Windows Analysis Report
PO_23052024.exe

Overview

General Information

Sample name:	PO_23052024.exe
Analysis ID:	1446505
MD5:	23626a822afb45c288acf9fabbef5ad1
SHA1:	4e0db9f021191084331d9ed7164f066fe1003f06
SHA256:	581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large strings

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Contains functionality to register a low level keyboard hook

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PO_23052024.exe (PID: 6824 cmdline: "C:\Users\user\Desktop\PO_23052024.exe" MD5: 23626A822AFB45C288ACF9FABBEF5AD1)

PO_23052024.exe (PID: 6972 cmdline: "C:\Users\user\Desktop\PO_23052024.exe" MD5: 23626A822AFB45C288ACF9FABBEF5AD1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alitextile.com", "Username": "9@alitextile.com", "Password": "Myname321@"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO_23052024.exe PID: 6824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO_23052024.exe PID: 6824	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO_23052024.exe PID: 6824	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO_23052024.exe PID: 6972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO_23052024.exe PID: 6972	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.PO_23052024.exe.44b34e0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_23052024.exe.44b34e0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_23052024.exe.44b34e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32129:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3219b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32225:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x322b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32321:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32393:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32429:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x324b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_23052024.exe.475e058.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_23052024.exe.475e058.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_23052024.exe.475e058.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32129:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3219b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32225:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x322b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32321:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32393:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32429:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x324b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_23052024.exe.44b34e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_23052024.exe.44b34e0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.PO_23052024.exe.44b34e0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_23052024.exe.44b34e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f29:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f9b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34025:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34121:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34193:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34229:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x342b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.PO_23052024.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.PO_23052024.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.PO_23052024.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.PO_23052024.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f29:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f9b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34025:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34121:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34193:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34229:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x342b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO_23052024.exe.475e058.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO_23052024.exe.475e058.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.PO_23052024.exe.475e058.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO_23052024.exe.475e058.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33f29:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f149:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f9b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f1bb:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34025:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f245:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x340b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f2d7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34121:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f341:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34193:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f3b3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34229:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f449:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x342b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f4d9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.185.143.105, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PO_23052024.exe, Initiated: true, ProcessId: 6972, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49734

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alitextile.com", "Username": "9@alitextile.com", "Password": "Myname321@"}

Multi AV Scanner detection for submitted file

Source: PO_23052024.exe	ReversingLabs: Detection: 42%
Source: PO_23052024.exe	Virustotal: Detection: 36%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO_23052024.exe

Joe Sandbox ML: detected

Source: PO_23052024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: PO_23052024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: HqVJ.pdb source: PO_23052024.exe
Source:	Binary string: HqVJ.pdbSHA256I source: PO_23052024.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.PO_23052024.exe.44b34e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO_23052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.alitextile.com

Source: PO_23052024.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: PO_23052024.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000031FA000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000368B000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alitextile.com
Source: PO_23052024.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000327A000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107937316.000000000679A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000327A000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107937316.000000000679A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: PO_23052024.exe, 00000001.00000002.4100635153.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO_23052024.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: PO_23052024.exe	String found in binary or memory: http://tempuri.org/registerationDataSet.xsdOAsnanyDentalClinic.Properties.Resources
Source: PO_23052024.exe, 00000001.00000002.4107285668.000000000678E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.
Source: PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108201561.00000000067AC000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000676B000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108762946.00000000067B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.0000000006736000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116932989.000000000A4E1000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108926498.00000000067D9000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108201561.00000000067AC000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000676B000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108762946.00000000067B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.0000000006736000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116932989.000000000A4E1000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108926498.00000000067D9000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: PO_23052024.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, 3DlgK9re6m.cs	.Net Code: TDa
Source: 0.2.PO_23052024.exe.44b34e0.3.raw.unpack, 3DlgK9re6m.cs	.Net Code: TDa

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\PO_23052024.exe

Code function: 1_2_06EE46D8 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,06EE5278,00000000,00000000

1_2_06EE46D8

Installs a global keyboard hook

Source: C:\Users\user\Desktop\PO_23052024.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\PO_23052024.exe

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.PO_23052024.exe.44b34e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_23052024.exe.475e058.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_23052024.exe.44b34e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.PO_23052024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large strings

Source: PO_23052024.exe, BufferingPage.cs

Long String: Length: 150953

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO_23052024.exe

Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 0_2_0172D384	0_2_0172D384
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_02FBB0B8	1_2_02FBB0B8
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_02FB41F0	1_2_02FB41F0
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_02FB4AC0	1_2_02FB4AC0
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_02FB3EA8	1_2_02FB3EA8
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E87E80	1_2_06E87E80
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E8D69C	1_2_06E8D69C
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E852A0	1_2_06E852A0
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E82358	1_2_06E82358
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E8B9A8	1_2_06E8B9A8
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E877A0	1_2_06E877A0
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E85A00	1_2_06E85A00
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E8EBE8	1_2_06E8EBE8
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E8EBE7	1_2_06E8EBE7
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E8F8DF	1_2_06E8F8DF
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E80040	1_2_06E80040
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06EEB3A8	1_2_06EEB3A8

Source: PO_23052024.exe

Static PE information: invalid certificate

Source: PO_23052024.exe, 00000000.00000000.1627439297.0000000000FC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHqVJ.exe" vs PO_23052024.exe
Source: PO_23052024.exe, 00000000.00000002.1652392360.000000000174E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO_23052024.exe
Source: PO_23052024.exe, 00000000.00000002.1652876983.000000000349E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7f4f14b4-d46b-42ba-b19b-0932f3eca6e2.exe4 vs PO_23052024.exe
Source: PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7f4f14b4-d46b-42ba-b19b-0932f3eca6e2.exe4 vs PO_23052024.exe
Source: PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO_23052024.exe
Source: PO_23052024.exe, 00000000.00000002.1655052359.0000000006890000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO_23052024.exe
Source: PO_23052024.exe, 00000000.00000002.1654647381.0000000005A60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO_23052024.exe
Source: PO_23052024.exe, 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7f4f14b4-d46b-42ba-b19b-0932f3eca6e2.exe4 vs PO_23052024.exe
Source: PO_23052024.exe, 00000001.00000002.4098302544.0000000001139000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO_23052024.exe
Source: PO_23052024.exe, 00000001.00000002.4098049822.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7f4f14b4-d46b-42ba-b19b-0932f3eca6e2.exe4 vs PO_23052024.exe
Source: PO_23052024.exe	Binary or memory string: OriginalFilenameHqVJ.exe" vs PO_23052024.exe

Source: PO_23052024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.PO_23052024.exe.44b34e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_23052024.exe.475e058.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_23052024.exe.44b34e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.PO_23052024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PO_23052024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, slKb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, mAKJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, xQRSe0Fg.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, n3rhMa.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, MQzE4FWn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, nSmgRyX5a1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, SedwyoakyMJQXm4srv.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.PO_23052024.exe.349e2a4.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.PO_23052024.exe.348e28c.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.PO_23052024.exe.5960000.6.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\PO_23052024.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_23052024.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Mutant created: NULL

Source: PO_23052024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO_23052024.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_23052024.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO_23052024.exe, 00000000.00000000.1627439297.0000000000FC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [patient] SET [patientId] = @patientId, [firstName] = @firstName, [lastName] = @lastName, [mobileNumber] = @mobileNumber, [email] = @email, [userName] = @userName, [password] = @password WHERE (([patientId] = @Original_patientId) AND ([firstName] = @Original_firstName) AND ([lastName] = @Original_lastName) AND ((@IsNull_mobileNumber = 1 AND [mobileNumber] IS NULL) OR ([mobileNumber] = @Original_mobileNumber)) AND ([email] = @Original_email) AND ([userName] = @Original_userName) AND ([password] = @Original_password));
Source: PO_23052024.exe, 00000000.00000000.1627439297.0000000000FC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [patient] SET [userName] = @userName, [password] = @password, [patientId] = @patientId WHERE (([userName] = @Original_userName) AND ([password] = @Original_password) AND ([patientId] = @Original_patientId));
Source: PO_23052024.exe, 00000000.00000000.1627439297.0000000000FC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [patient] ([patientId], [firstName], [lastName], [mobileNumber], [email], [userName], [password]) VALUES (@patientId, @firstName, @lastName, @mobileNumber, @email, @userName, @password);

Source: PO_23052024.exe	ReversingLabs: Detection: 42%
Source: PO_23052024.exe	Virustotal: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\PO_23052024.exe "C:\Users\user\Desktop\PO_23052024.exe"
Source: C:\Users\user\Desktop\PO_23052024.exe	Process created: C:\Users\user\Desktop\PO_23052024.exe "C:\Users\user\Desktop\PO_23052024.exe"
Source: C:\Users\user\Desktop\PO_23052024.exe	Process created: C:\Users\user\Desktop\PO_23052024.exe "C:\Users\user\Desktop\PO_23052024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO_23052024.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO_23052024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO_23052024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PO_23052024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: HqVJ.pdb source: PO_23052024.exe
Source:	Binary string: HqVJ.pdbSHA256I source: PO_23052024.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: PO_23052024.exe, BufferingPage.cs	.Net Code: InitializeComponent
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, SedwyoakyMJQXm4srv.cs	.Net Code: JkrbtDgMNG System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO_23052024.exe.5a60000.7.raw.unpack, LoginForm.cs	.Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, SedwyoakyMJQXm4srv.cs	.Net Code: JkrbtDgMNG System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, SedwyoakyMJQXm4srv.cs	.Net Code: JkrbtDgMNG System.Reflection.Assembly.Load(byte[])

Source: PO_23052024.exe

Static PE information: 0xA89BEBA9 [Fri Aug 22 15:11:37 2059 UTC]

Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_02FBA838 push esp; retf	1_2_02FBAEE1
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_02FB8B37 push eax; iretd	1_2_02FB8B41
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_02FB0C55 push edi; retf	1_2_02FB0C7A
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06E862D8 push eax; iretd	1_2_06E862EA
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06EEE5D1 push es; ret	1_2_06EEE5E0
Source: C:\Users\user\Desktop\PO_23052024.exe	Code function: 1_2_06EE6CC8 pushfd ; iretd	1_2_06EE6CD5

Source: PO_23052024.exe

Static PE information: section name: .text entropy: 6.989965875411954

Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, SedwyoakyMJQXm4srv.cs	High entropy of concatenated method names: 'SGfyc2VEbK', 'tBHyEedkJs', 'pQOyPwJsyY', 'hhYy5wUZhB', 'w6jyfb2xdS', 'TqiyBdFTDa', 'NyqymUrbDF', 'j7IyapHDcQ', 'H7ZyvwV0rH', 'wiUyr3UPvJ'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, jmB1KAUkkDqnT2RK2I.cs	High entropy of concatenated method names: 'bsHZrupvqs', 'NxCZMGO5hg', 'ToString', 'osWZEJu4Tn', 'bqhZPTg15X', 'JvgZ5FCpvr', 'wy8ZfGF7OA', 'OKkZB2sJWt', 'nIBZmXOEdG', 'qflZanY2Zj'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, Pt4vmpouCYfg0AiYBm.cs	High entropy of concatenated method names: 'XjhZWQ3FsX', 'n9MZ2LRky0', 'GWlpNqWsh4', 'jtMpIT8WWd', 'C2fZgYVknk', 'lfxZ9RB9Sy', 'EUSZ1T3JGj', 'bB8ZKoFrD5', 'emWZwGNfUk', 'o9PZLQGobk'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, BTvxVRuFOcGC4swOwH.cs	High entropy of concatenated method names: 'cBLmE0Yttw', 'hbtm5vj1Jf', 'f24mBNRb56', 'jABB24k2i6', 'N7nBzpbieP', 'zD2mNDMVoE', 'YWHmIqDZRk', 'Pkom31liwy', 'q4Imyp5UkI', 'guNmbyShLV'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, KAMKho8eKFH4faEbDi.cs	High entropy of concatenated method names: 'FsNpxVYsUv', 'Ksnp6FQnLk', 'dS2pSWK1qX', 'GbFpY7nkOk', 'lmFpKUOuLA', 'syMpjTIlRX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, yvrhqoKVXZi4LgAJ2p.cs	High entropy of concatenated method names: 'Vc8sQsGLag', 'UTWs9CdbI3', 'NgPsKmcdl0', 'DMSsww8oE8', 's2Js6I8AmL', 'K1xsS4oPsp', 'vMssYcHtG9', 'ShRsjEqB0d', 'dMssARXDJF', 'zVfsuh3yHX'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, nWCeH9kauReiKWObye.cs	High entropy of concatenated method names: 'Fsc5OlVuQd', 'f245CyxehD', 'xdZ5nbo8gM', 'lbh5kd9gOb', 'ehi5sPhFdp', 'dWt5iqaQbC', 'c8M5Z4Eu1I', 'hIE5p7DZOo', 'JxA5VayCti', 'TsY5qGRoaa'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	High entropy of concatenated method names: 'krhPK56eSf', 'zBwPw8MZ0P', 'hWvPL1G8wU', 'K96PU4FsdK', 'yshPRQWJQM', 'LD3PobvW2Z', 'v6UPH3OUaw', 'QOUPWRFMSb', 'dE3P8lG8yo', 'I36P2ynYP6'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, llgy1DxyG2JFvShotY.cs	High entropy of concatenated method names: 'CPdBcXLhhG', 'tYEBPqsNPJ', 'uPRBfO3Jht', 'lK3Bm7I6dc', 'ovEBaNj9Hg', 'G9OfRaubdC', 'k6HfotVdw6', 'k2ifHs65bI', 'Tm4fWcaO6W', 'DgVf8DbUe7'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, zaW8hGd5vJRe3S4kvv.cs	High entropy of concatenated method names: 'BZOfeHISja', 'HjTfJH5tT0', 'qGQ5SZIoZY', 'Miw5Y31hHd', 'Kkv5jnpS4S', 'Dny5AGqMZH', 'Ymj5upvFYq', 'Wlu5Fqc4C9', 'KPR54U42YW', 'vSN5QbCsiW'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, Y94WI92gUZyJa9brvN.cs	High entropy of concatenated method names: 'Fc5VIAgdbv', 'E14VykXHIM', 'CCWVbGrTAI', 'wJPVEtZdAL', 'tmpVPNCwL0', 'Pp8VfwGZyF', 'trkVB0bYnV', 'SuVpHYEqc9', 'KhhpWvlqN3', 'XbFp80e7HG'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, r9Qw0UINecGL81cmUeI.cs	High entropy of concatenated method names: 'NLtVT6QNUi', 'DWrVlgtewu', 'tRCVtH8DbP', 'mLeVORc91o', 'OWJVeQmmfW', 't8BVCgSCni', 'UujVJe8BWs', 'KujVnLpibV', 'hWHVknIINC', 'jwtVdmTkjT'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, a1pNlo3CFJKJGAyMRi.cs	High entropy of concatenated method names: 'gBJtUSZmp', 'GbROAwXNK', 'rgOCaOyqQ', 'Y97JyQJ88', 'JD8kRMb6A', 'cdQdx0eLi', 'MmEq5KZV92gK5qP2p4', 'MV8jgAx3V7OCaDCjOe', 'WBppEvYwY', 'dNoqToLau'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, hqttQ9LZ14PnL7ZC7U.cs	High entropy of concatenated method names: 'ToString', 'S6Wigy7geY', 'FNCi6DijH9', 'mn0iS34JmH', 'IdwiYTcnFa', 'Eetijb5re5', 'L8QiAOjLE0', 'ONEiuTXGYA', 'hLOiFrUvkM', 'UMTi4o8LTK'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, tY7w7jIyRSJAb5xHoXA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XcaqKDv5UG', 'n0bqwqtvTd', 'uCLqLLR8ri', 'mKLqU5deVK', 'N35qRFnLpk', 'VAiqoyhOCP', 'ebaqHK4Fwp'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, gr5UF04U9HmL7x664a.cs	High entropy of concatenated method names: 'xNxmTpYl11', 'bWYmllowHj', 'xuCmtHxiTC', 'dt1mOGWu6r', 'l5fmexkQcX', 'xGmmCsggnV', 'lL0mJbnUDQ', 'hu9mnQY36s', 'meMmkTHIBW', 'MRVmdCNBRQ'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, rFYeuPIIXUWaDE8qekq.cs	High entropy of concatenated method names: 'ToString', 'COxqyo7MNB', 'uYbqbu2jJv', 'yP5qcNBlwm', 'M9eqEdu7ZA', 'TO9qPsp8MA', 'kcEq5U30Cm', 'TllqfTTcmW', 'asfNP7Qkm29yEbvxa5g', 'VxWgURQ51L8Cp8hMKpP'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, eX6Pv914m8f69NpEtr.cs	High entropy of concatenated method names: 'JYIXn8toKu', 'IFLXkALcoL', 'wL8XxCbfRo', 'oLBX6dE7yK', 'RI3XYoqm8u', 'Fs9XjAJnAT', 'D8BXuCKSFI', 'I4nXFTfP9M', 'vW0XQgw4w5', 'ao4Xg1vfPy'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, dLmnBibU4QQaT2xxCq.cs	High entropy of concatenated method names: 'bc5ImgVCG1', 'qUfIasxYmN', 'PauIrReiKW', 'AbyIMetaW8', 'H4kIsvvvlg', 'c1DIiyG2JF', 'cruUP8X0JASP89ObxD', 'E615hinHGC2kXO6lZ6', 'cxbIIn21B5', 'l7GIy4Sa67'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, FOsphLPNZfbMrObuDf.cs	High entropy of concatenated method names: 'Dispose', 'X0yI8GT1e9', 'SD636NO5XQ', 'UoTggXdet8', 'rMCI2n38jN', 'AknIz8Xuip', 'ProcessDialogKey', 'F7A3NAMKho', 'BKF3IH4faE', 'eDi33294WI'
Source: 0.2.PO_23052024.exe.48d4b48.4.raw.unpack, nCn38jWNOkn8Xuipx7.cs	High entropy of concatenated method names: 'JLUpEH8YGM', 'EmEpPuc8y9', 'EPlp5B4TkG', 'VkTpf1wfWk', 'nqTpBy9v9U', 'tb5pmCcPoG', 'vKDpaj2you', 'z8QpvqFy1x', 'MyKprBcsUX', 'tIApM6UR4M'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, SedwyoakyMJQXm4srv.cs	High entropy of concatenated method names: 'SGfyc2VEbK', 'tBHyEedkJs', 'pQOyPwJsyY', 'hhYy5wUZhB', 'w6jyfb2xdS', 'TqiyBdFTDa', 'NyqymUrbDF', 'j7IyapHDcQ', 'H7ZyvwV0rH', 'wiUyr3UPvJ'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, jmB1KAUkkDqnT2RK2I.cs	High entropy of concatenated method names: 'bsHZrupvqs', 'NxCZMGO5hg', 'ToString', 'osWZEJu4Tn', 'bqhZPTg15X', 'JvgZ5FCpvr', 'wy8ZfGF7OA', 'OKkZB2sJWt', 'nIBZmXOEdG', 'qflZanY2Zj'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, Pt4vmpouCYfg0AiYBm.cs	High entropy of concatenated method names: 'XjhZWQ3FsX', 'n9MZ2LRky0', 'GWlpNqWsh4', 'jtMpIT8WWd', 'C2fZgYVknk', 'lfxZ9RB9Sy', 'EUSZ1T3JGj', 'bB8ZKoFrD5', 'emWZwGNfUk', 'o9PZLQGobk'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, BTvxVRuFOcGC4swOwH.cs	High entropy of concatenated method names: 'cBLmE0Yttw', 'hbtm5vj1Jf', 'f24mBNRb56', 'jABB24k2i6', 'N7nBzpbieP', 'zD2mNDMVoE', 'YWHmIqDZRk', 'Pkom31liwy', 'q4Imyp5UkI', 'guNmbyShLV'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, KAMKho8eKFH4faEbDi.cs	High entropy of concatenated method names: 'FsNpxVYsUv', 'Ksnp6FQnLk', 'dS2pSWK1qX', 'GbFpY7nkOk', 'lmFpKUOuLA', 'syMpjTIlRX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, yvrhqoKVXZi4LgAJ2p.cs	High entropy of concatenated method names: 'Vc8sQsGLag', 'UTWs9CdbI3', 'NgPsKmcdl0', 'DMSsww8oE8', 's2Js6I8AmL', 'K1xsS4oPsp', 'vMssYcHtG9', 'ShRsjEqB0d', 'dMssARXDJF', 'zVfsuh3yHX'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, nWCeH9kauReiKWObye.cs	High entropy of concatenated method names: 'Fsc5OlVuQd', 'f245CyxehD', 'xdZ5nbo8gM', 'lbh5kd9gOb', 'ehi5sPhFdp', 'dWt5iqaQbC', 'c8M5Z4Eu1I', 'hIE5p7DZOo', 'JxA5VayCti', 'TsY5qGRoaa'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	High entropy of concatenated method names: 'krhPK56eSf', 'zBwPw8MZ0P', 'hWvPL1G8wU', 'K96PU4FsdK', 'yshPRQWJQM', 'LD3PobvW2Z', 'v6UPH3OUaw', 'QOUPWRFMSb', 'dE3P8lG8yo', 'I36P2ynYP6'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, llgy1DxyG2JFvShotY.cs	High entropy of concatenated method names: 'CPdBcXLhhG', 'tYEBPqsNPJ', 'uPRBfO3Jht', 'lK3Bm7I6dc', 'ovEBaNj9Hg', 'G9OfRaubdC', 'k6HfotVdw6', 'k2ifHs65bI', 'Tm4fWcaO6W', 'DgVf8DbUe7'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, zaW8hGd5vJRe3S4kvv.cs	High entropy of concatenated method names: 'BZOfeHISja', 'HjTfJH5tT0', 'qGQ5SZIoZY', 'Miw5Y31hHd', 'Kkv5jnpS4S', 'Dny5AGqMZH', 'Ymj5upvFYq', 'Wlu5Fqc4C9', 'KPR54U42YW', 'vSN5QbCsiW'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, Y94WI92gUZyJa9brvN.cs	High entropy of concatenated method names: 'Fc5VIAgdbv', 'E14VykXHIM', 'CCWVbGrTAI', 'wJPVEtZdAL', 'tmpVPNCwL0', 'Pp8VfwGZyF', 'trkVB0bYnV', 'SuVpHYEqc9', 'KhhpWvlqN3', 'XbFp80e7HG'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, r9Qw0UINecGL81cmUeI.cs	High entropy of concatenated method names: 'NLtVT6QNUi', 'DWrVlgtewu', 'tRCVtH8DbP', 'mLeVORc91o', 'OWJVeQmmfW', 't8BVCgSCni', 'UujVJe8BWs', 'KujVnLpibV', 'hWHVknIINC', 'jwtVdmTkjT'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, a1pNlo3CFJKJGAyMRi.cs	High entropy of concatenated method names: 'gBJtUSZmp', 'GbROAwXNK', 'rgOCaOyqQ', 'Y97JyQJ88', 'JD8kRMb6A', 'cdQdx0eLi', 'MmEq5KZV92gK5qP2p4', 'MV8jgAx3V7OCaDCjOe', 'WBppEvYwY', 'dNoqToLau'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, hqttQ9LZ14PnL7ZC7U.cs	High entropy of concatenated method names: 'ToString', 'S6Wigy7geY', 'FNCi6DijH9', 'mn0iS34JmH', 'IdwiYTcnFa', 'Eetijb5re5', 'L8QiAOjLE0', 'ONEiuTXGYA', 'hLOiFrUvkM', 'UMTi4o8LTK'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, tY7w7jIyRSJAb5xHoXA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XcaqKDv5UG', 'n0bqwqtvTd', 'uCLqLLR8ri', 'mKLqU5deVK', 'N35qRFnLpk', 'VAiqoyhOCP', 'ebaqHK4Fwp'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, gr5UF04U9HmL7x664a.cs	High entropy of concatenated method names: 'xNxmTpYl11', 'bWYmllowHj', 'xuCmtHxiTC', 'dt1mOGWu6r', 'l5fmexkQcX', 'xGmmCsggnV', 'lL0mJbnUDQ', 'hu9mnQY36s', 'meMmkTHIBW', 'MRVmdCNBRQ'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, rFYeuPIIXUWaDE8qekq.cs	High entropy of concatenated method names: 'ToString', 'COxqyo7MNB', 'uYbqbu2jJv', 'yP5qcNBlwm', 'M9eqEdu7ZA', 'TO9qPsp8MA', 'kcEq5U30Cm', 'TllqfTTcmW', 'asfNP7Qkm29yEbvxa5g', 'VxWgURQ51L8Cp8hMKpP'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, eX6Pv914m8f69NpEtr.cs	High entropy of concatenated method names: 'JYIXn8toKu', 'IFLXkALcoL', 'wL8XxCbfRo', 'oLBX6dE7yK', 'RI3XYoqm8u', 'Fs9XjAJnAT', 'D8BXuCKSFI', 'I4nXFTfP9M', 'vW0XQgw4w5', 'ao4Xg1vfPy'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, dLmnBibU4QQaT2xxCq.cs	High entropy of concatenated method names: 'bc5ImgVCG1', 'qUfIasxYmN', 'PauIrReiKW', 'AbyIMetaW8', 'H4kIsvvvlg', 'c1DIiyG2JF', 'cruUP8X0JASP89ObxD', 'E615hinHGC2kXO6lZ6', 'cxbIIn21B5', 'l7GIy4Sa67'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, FOsphLPNZfbMrObuDf.cs	High entropy of concatenated method names: 'Dispose', 'X0yI8GT1e9', 'SD636NO5XQ', 'UoTggXdet8', 'rMCI2n38jN', 'AknIz8Xuip', 'ProcessDialogKey', 'F7A3NAMKho', 'BKF3IH4faE', 'eDi33294WI'
Source: 0.2.PO_23052024.exe.4857f28.5.raw.unpack, nCn38jWNOkn8Xuipx7.cs	High entropy of concatenated method names: 'JLUpEH8YGM', 'EmEpPuc8y9', 'EPlp5B4TkG', 'VkTpf1wfWk', 'nqTpBy9v9U', 'tb5pmCcPoG', 'vKDpaj2you', 'z8QpvqFy1x', 'MyKprBcsUX', 'tIApM6UR4M'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, SedwyoakyMJQXm4srv.cs	High entropy of concatenated method names: 'SGfyc2VEbK', 'tBHyEedkJs', 'pQOyPwJsyY', 'hhYy5wUZhB', 'w6jyfb2xdS', 'TqiyBdFTDa', 'NyqymUrbDF', 'j7IyapHDcQ', 'H7ZyvwV0rH', 'wiUyr3UPvJ'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, jmB1KAUkkDqnT2RK2I.cs	High entropy of concatenated method names: 'bsHZrupvqs', 'NxCZMGO5hg', 'ToString', 'osWZEJu4Tn', 'bqhZPTg15X', 'JvgZ5FCpvr', 'wy8ZfGF7OA', 'OKkZB2sJWt', 'nIBZmXOEdG', 'qflZanY2Zj'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, Pt4vmpouCYfg0AiYBm.cs	High entropy of concatenated method names: 'XjhZWQ3FsX', 'n9MZ2LRky0', 'GWlpNqWsh4', 'jtMpIT8WWd', 'C2fZgYVknk', 'lfxZ9RB9Sy', 'EUSZ1T3JGj', 'bB8ZKoFrD5', 'emWZwGNfUk', 'o9PZLQGobk'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, BTvxVRuFOcGC4swOwH.cs	High entropy of concatenated method names: 'cBLmE0Yttw', 'hbtm5vj1Jf', 'f24mBNRb56', 'jABB24k2i6', 'N7nBzpbieP', 'zD2mNDMVoE', 'YWHmIqDZRk', 'Pkom31liwy', 'q4Imyp5UkI', 'guNmbyShLV'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, KAMKho8eKFH4faEbDi.cs	High entropy of concatenated method names: 'FsNpxVYsUv', 'Ksnp6FQnLk', 'dS2pSWK1qX', 'GbFpY7nkOk', 'lmFpKUOuLA', 'syMpjTIlRX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, yvrhqoKVXZi4LgAJ2p.cs	High entropy of concatenated method names: 'Vc8sQsGLag', 'UTWs9CdbI3', 'NgPsKmcdl0', 'DMSsww8oE8', 's2Js6I8AmL', 'K1xsS4oPsp', 'vMssYcHtG9', 'ShRsjEqB0d', 'dMssARXDJF', 'zVfsuh3yHX'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, nWCeH9kauReiKWObye.cs	High entropy of concatenated method names: 'Fsc5OlVuQd', 'f245CyxehD', 'xdZ5nbo8gM', 'lbh5kd9gOb', 'ehi5sPhFdp', 'dWt5iqaQbC', 'c8M5Z4Eu1I', 'hIE5p7DZOo', 'JxA5VayCti', 'TsY5qGRoaa'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, hgVCG1nZUfsxYmN0g5.cs	High entropy of concatenated method names: 'krhPK56eSf', 'zBwPw8MZ0P', 'hWvPL1G8wU', 'K96PU4FsdK', 'yshPRQWJQM', 'LD3PobvW2Z', 'v6UPH3OUaw', 'QOUPWRFMSb', 'dE3P8lG8yo', 'I36P2ynYP6'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, llgy1DxyG2JFvShotY.cs	High entropy of concatenated method names: 'CPdBcXLhhG', 'tYEBPqsNPJ', 'uPRBfO3Jht', 'lK3Bm7I6dc', 'ovEBaNj9Hg', 'G9OfRaubdC', 'k6HfotVdw6', 'k2ifHs65bI', 'Tm4fWcaO6W', 'DgVf8DbUe7'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, zaW8hGd5vJRe3S4kvv.cs	High entropy of concatenated method names: 'BZOfeHISja', 'HjTfJH5tT0', 'qGQ5SZIoZY', 'Miw5Y31hHd', 'Kkv5jnpS4S', 'Dny5AGqMZH', 'Ymj5upvFYq', 'Wlu5Fqc4C9', 'KPR54U42YW', 'vSN5QbCsiW'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, Y94WI92gUZyJa9brvN.cs	High entropy of concatenated method names: 'Fc5VIAgdbv', 'E14VykXHIM', 'CCWVbGrTAI', 'wJPVEtZdAL', 'tmpVPNCwL0', 'Pp8VfwGZyF', 'trkVB0bYnV', 'SuVpHYEqc9', 'KhhpWvlqN3', 'XbFp80e7HG'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, r9Qw0UINecGL81cmUeI.cs	High entropy of concatenated method names: 'NLtVT6QNUi', 'DWrVlgtewu', 'tRCVtH8DbP', 'mLeVORc91o', 'OWJVeQmmfW', 't8BVCgSCni', 'UujVJe8BWs', 'KujVnLpibV', 'hWHVknIINC', 'jwtVdmTkjT'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, a1pNlo3CFJKJGAyMRi.cs	High entropy of concatenated method names: 'gBJtUSZmp', 'GbROAwXNK', 'rgOCaOyqQ', 'Y97JyQJ88', 'JD8kRMb6A', 'cdQdx0eLi', 'MmEq5KZV92gK5qP2p4', 'MV8jgAx3V7OCaDCjOe', 'WBppEvYwY', 'dNoqToLau'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, hqttQ9LZ14PnL7ZC7U.cs	High entropy of concatenated method names: 'ToString', 'S6Wigy7geY', 'FNCi6DijH9', 'mn0iS34JmH', 'IdwiYTcnFa', 'Eetijb5re5', 'L8QiAOjLE0', 'ONEiuTXGYA', 'hLOiFrUvkM', 'UMTi4o8LTK'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, tY7w7jIyRSJAb5xHoXA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XcaqKDv5UG', 'n0bqwqtvTd', 'uCLqLLR8ri', 'mKLqU5deVK', 'N35qRFnLpk', 'VAiqoyhOCP', 'ebaqHK4Fwp'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, gr5UF04U9HmL7x664a.cs	High entropy of concatenated method names: 'xNxmTpYl11', 'bWYmllowHj', 'xuCmtHxiTC', 'dt1mOGWu6r', 'l5fmexkQcX', 'xGmmCsggnV', 'lL0mJbnUDQ', 'hu9mnQY36s', 'meMmkTHIBW', 'MRVmdCNBRQ'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, rFYeuPIIXUWaDE8qekq.cs	High entropy of concatenated method names: 'ToString', 'COxqyo7MNB', 'uYbqbu2jJv', 'yP5qcNBlwm', 'M9eqEdu7ZA', 'TO9qPsp8MA', 'kcEq5U30Cm', 'TllqfTTcmW', 'asfNP7Qkm29yEbvxa5g', 'VxWgURQ51L8Cp8hMKpP'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, eX6Pv914m8f69NpEtr.cs	High entropy of concatenated method names: 'JYIXn8toKu', 'IFLXkALcoL', 'wL8XxCbfRo', 'oLBX6dE7yK', 'RI3XYoqm8u', 'Fs9XjAJnAT', 'D8BXuCKSFI', 'I4nXFTfP9M', 'vW0XQgw4w5', 'ao4Xg1vfPy'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, dLmnBibU4QQaT2xxCq.cs	High entropy of concatenated method names: 'bc5ImgVCG1', 'qUfIasxYmN', 'PauIrReiKW', 'AbyIMetaW8', 'H4kIsvvvlg', 'c1DIiyG2JF', 'cruUP8X0JASP89ObxD', 'E615hinHGC2kXO6lZ6', 'cxbIIn21B5', 'l7GIy4Sa67'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, FOsphLPNZfbMrObuDf.cs	High entropy of concatenated method names: 'Dispose', 'X0yI8GT1e9', 'SD636NO5XQ', 'UoTggXdet8', 'rMCI2n38jN', 'AknIz8Xuip', 'ProcessDialogKey', 'F7A3NAMKho', 'BKF3IH4faE', 'eDi33294WI'
Source: 0.2.PO_23052024.exe.6890000.8.raw.unpack, nCn38jWNOkn8Xuipx7.cs	High entropy of concatenated method names: 'JLUpEH8YGM', 'EmEpPuc8y9', 'EPlp5B4TkG', 'VkTpf1wfWk', 'nqTpBy9v9U', 'tb5pmCcPoG', 'vKDpaj2you', 'z8QpvqFy1x', 'MyKprBcsUX', 'tIApM6UR4M'

Source: C:\Users\user\Desktop\PO_23052024.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO_23052024.exe PID: 6824, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO_23052024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO_23052024.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 1700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 3460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 1940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 6A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 7A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 7B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 8B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 31B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599195	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599075	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598903	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598745	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe	Window / User API: threadDelayed 1135			Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Window / User API: threadDelayed 8692			Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe TID: 6128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599195s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -599075s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -598903s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -598745s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -99014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe TID: 7200	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO_23052024.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_23052024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599195	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 599075	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598903	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598745	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99563	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 99014	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: PO_23052024.exe, 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PO_23052024.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\PO_23052024.exe

Code function: 1_2_02FB7ED0 CheckRemoteDebuggerPresent,

1_2_02FB7ED0

Source: C:\Users\user\Desktop\PO_23052024.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Process created: C:\Users\user\Desktop\PO_23052024.exe "C:\Users\user\Desktop\PO_23052024.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Users\user\Desktop\PO_23052024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Users\user\Desktop\PO_23052024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO_23052024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO_23052024.exe.44b34e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.475e058.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.44b34e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO_23052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_23052024.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO_23052024.exe PID: 6972, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO_23052024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PO_23052024.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\PO_23052024.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.PO_23052024.exe.44b34e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.475e058.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.44b34e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO_23052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_23052024.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO_23052024.exe PID: 6972, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO_23052024.exe.44b34e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.475e058.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.44b34e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO_23052024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO_23052024.exe.475e058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_23052024.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO_23052024.exe PID: 6972, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	31 Input Capture	34 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	531 Security Software Discovery	Distributed Component Object Model	31 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO_23052024.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
PO_23052024.exe	36%	Virustotal		Browse
PO_23052024.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.ipify.org	1%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
mail.alitextile.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://tempuri.org/DataSet1.xsd	0%	URL Reputation	safe
http://tempuri.org/registerationDataSet.xsdOAsnanyDentalClinic.Properties.Resources	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://x1.c.	0%	Avira URL Cloud	safe
http://mail.alitextile.com	0%	Avira URL Cloud	safe
http://tempuri.org/registerationDataSet.xsdOAsnanyDentalClinic.Properties.Resources	1%	Virustotal		Browse
http://mail.alitextile.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false	1%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
mail.alitextile.com	192.185.143.105	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/registerationDataSet.xsdOAsnanyDentalClinic.Properties.Resources	PO_23052024.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	PO_23052024.exe, 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108201561.00000000067AC000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000676B000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108762946.00000000067B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.0000000006736000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116932989.000000000A4E1000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108926498.00000000067D9000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108201561.00000000067AC000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000676B000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108762946.00000000067B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.0000000006736000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116932989.000000000A4E1000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108926498.00000000067D9000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.alitextile.com	PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000368B000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/DataSet1.xsd	PO_23052024.exe	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000327A000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107937316.000000000679A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO_23052024.exe, 00000001.00000002.4100635153.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	PO_23052024.exe	false	URL Reputation: safe	unknown
http://x1.c.	PO_23052024.exe, 00000001.00000002.4107285668.000000000678E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	PO_23052024.exe, 00000001.00000002.4098769482.000000000133E000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003406000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003362000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4108862222.00000000067C6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.0000000003540000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4116822748.000000000A4B6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000034A7000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107285668.000000000678A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4117353080.000000000A538000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000035EF000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4098769482.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4099457587.000000000137A000.00000004.00000020.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4100635153.000000000327A000.00000004.00000800.00020000.00000000.sdmp, PO_23052024.exe, 00000001.00000002.4107937316.000000000679A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
192.185.143.105	mail.alitextile.com	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446505
Start date and time:	2024-05-23 15:14:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO_23052024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 51 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:14:54	API Interceptor	9855726x Sleep call for process: PO_23052024.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	MOLEX 436500304-10000.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	t3h7DNer1Q.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	ip-api.com/line/?fields=hosting
	INVOICE.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	C30XdMP03R.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	NTgo4SxmS3.exe	Get hash	malicious	Blank Grabber, DCRat	Browse	ip-api.com/json/?fields=225545
	SecuriteInfo.com.PowerShell.Siggen.2046.5121.22247.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
104.26.12.205	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	MOLEX 436500304-10000.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	t3h7DNer1Q.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	208.95.112.1
	INVOICE.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	C30XdMP03R.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	NTgo4SxmS3.exe	Get hash	malicious	Blank Grabber, DCRat	Browse	208.95.112.1
	SecuriteInfo.com.PowerShell.Siggen.2046.5121.22247.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	ASCD0001 INQ9829......pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://t.co/COiSlB3Tom	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	Zam#U00f3w nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	NEW ORDER.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	pro-forma invoice.xlsm.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Order PS24S0040.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://greettive-tke-783743.pages.dev/help/contact/95094729232531	Get hash	malicious	Unknown	Browse	104.26.12.205
	948209184.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
mail.alitextile.com	PO_21052024.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO_#20241705.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO_20240516.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO_202405014.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.143.105
	Purchase Order_#400086587.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.143.105
	Purchase Order_#400388875.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.143.105
	cir0tBXcdO.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	http://chocolatefashiononline.com	Get hash	malicious	Unknown	Browse	192.185.181.216
	ELECTRONIC RECEIPT_Rockwool.html	Get hash	malicious	Unknown	Browse	162.240.231.208
	yzKJORP7Q4.elf	Get hash	malicious	Mirai, Moobot	Browse	142.7.14.96
	4rg5Y5MHO8.elf	Get hash	malicious	Mirai, Moobot	Browse	142.7.14.96
	w5c8CHID77.exe	Get hash	malicious	Unknown	Browse	74.220.199.6
	SecuriteInfo.com.Trojan.DownLoad3.33216.13863.20878.exe	Get hash	malicious	Unknown	Browse	192.254.232.193
	https://wrt.dvw.mybluehost.me/CH/SBB/index/	Get hash	malicious	Unknown	Browse	162.241.225.162
	DHL INVOICE.scr.exe	Get hash	malicious	AgentTesla	Browse	162.214.80.31
	file.exe	Get hash	malicious	CMSBrute	Browse	162.215.2.27
	DHL INVOICE.scr.exe	Get hash	malicious	AgentTesla	Browse	162.214.80.31
CLOUDFLARENETUS	hesaphareketi-015232024.SCR.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ORDEM DE COMPRA.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://chocolatefashiononline.com	Get hash	malicious	Unknown	Browse	104.19.178.52
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	https://lnk.sk/mzoy	Get hash	malicious	Unknown	Browse	172.67.176.2
	https://lnk.sk/twr3	Get hash	malicious	Unknown	Browse	104.21.48.17
	COMMANDE.EXE.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.5.109
	t3h7DNer1Q.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	104.16.185.241
	https://docs.google.com/forms/d/e/1FAIpQLSeRYIPr_Xs8SxtWD9VaAhgsz9aibS_bijyTwdbidiIQ4ngVlQ/viewform?embedded=true&entry.1325074572=http%3A%2F%2Fr.smtp.euro-symbiose.fr%2Ftr%2Fcl%2Fqrjz6G3WMajAukEuXu-N0Qebu__8ljHwQjs84-vbNFkstMs8BrqGB6auM8cV52vdc-z8kda-O1XzLDMdp-o1VJ_xiAbOzr9v5pxwTGj0Dst_LdwxxKSPofjHdg7nt8IDlgUJ3uTEcfUBoqUeYZ1z6UfsaMJ-LJXtWMT4Mwb9atjObh_1JANJ5jvL-GurRI94WpyXTvnXhmqNG1ThqZzYQSaX5jfeHHDV6kb8kSgWbW5xuXgTilqIdc91eM30NL2GhrRlNADqergaHf7cyAh4WnSBK&entry.731640200=build-verify+URL%3A+build+UrlParams%3A+build-verify+URL%3A+get+URL%3A+decrypt%3A+base64+decode%3A+illegal+base64+data+at+input+byte+280	Get hash	malicious	Unknown	Browse	1.1.1.1
	RE Fasthosts - Payment Failed.eml	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.18.10.14
TUT-ASUS	MOLEX 436500304-10000.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	t3h7DNer1Q.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	208.95.112.1
	INVOICE.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	C30XdMP03R.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	NTgo4SxmS3.exe	Get hash	malicious	Blank Grabber, DCRat	Browse	208.95.112.1
	SecuriteInfo.com.PowerShell.Siggen.2046.5121.22247.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	hesaphareketi-015232024.SCR.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	ORDEM DE COMPRA.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.12.205
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	ASCD0001 INQ9829......pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.12.205
	msimg32.dll	Get hash	malicious	Remcos	Browse	104.26.12.205
	https://url10.mailanyone.net/scanner?m=1s9Mri-0007hx-3T&d=4%7Cmail%2F90%2F1716287400%2F1s9Mri-0007hx-3T%7Cin10g%7C57e1b682%7C12862802%7C10019077%7C664C7952D245399BD4B163183C53C253&o=%2Fphte%3A%2Fdtsseedrontec.iuconsctomat%2Fku.&s=X3gWuPbJRU1Tmui7Qt2w30qEumE	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	INVOICE.js	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Zam#U00f3w nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	NEW ORDER.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\PO_23052024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.002050746639198
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO_23052024.exe
File size:	924'168 bytes
MD5:	23626a822afb45c288acf9fabbef5ad1
SHA1:	4e0db9f021191084331d9ed7164f066fe1003f06
SHA256:	581ebd71502e26428ff03f5d743fbea09b17d22779e739c41022ac41cfac0242
SHA512:	6d098502008b94d46abd74bbc5a9c53f7101da6538f44e634fb2556e970950474193c43de03dd37f56442fb4a5e47a6449f462e3a598a10602f20851f178b2b6
SSDEEP:	12288:C8zWaRWoy6JBmtWTDNO9UEJEgR4ADxRuAoZzqCqw+FWzu7rxK4qLEDkR:C8zWMMcBXTPg7CqwQrFo1
TLSH:	6B158D3D18F922E29164C6A8CFE0C627B410F4EA30936935A9D28B55575BE0FBDC327D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4df812
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA89BEBA9 [Fri Aug 22 15:11:37 2059 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdf7bf	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe0000	0x55c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xde400	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xddbc8	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdd818	0xdda00	91c10c39c0d4a950c8db2cd19275ce12	False	0.7085734806824591	data	6.989965875411954	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe0000	0x55c	0x600	895e1914068a558e688da2bfacdd1117	False	0.3984375	data	3.909581881754366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe2000	0xc	0x200	0906f14d84f4048adecf40728c5a10fc	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0090	0x2cc	data			0.4301675977653631
RT_MANIFEST	0xe036c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 15:14:57.264163971 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:57.264234066 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:57.264317036 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:57.274226904 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:57.274240017 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:57.868662119 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:57.868797064 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:57.871728897 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:57.871738911 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:57.872033119 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:57.918103933 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:57.921597004 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:57.962510109 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:58.144531965 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:58.144602060 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 15:14:58.144654989 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:58.159373045 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 15:14:58.211792946 CEST	49733	80	192.168.2.4	208.95.112.1
May 23, 2024 15:14:58.218539953 CEST	80	49733	208.95.112.1	192.168.2.4
May 23, 2024 15:14:58.218657970 CEST	49733	80	192.168.2.4	208.95.112.1
May 23, 2024 15:14:58.218795061 CEST	49733	80	192.168.2.4	208.95.112.1
May 23, 2024 15:14:58.272778034 CEST	80	49733	208.95.112.1	192.168.2.4
May 23, 2024 15:14:58.720228910 CEST	80	49733	208.95.112.1	192.168.2.4
May 23, 2024 15:14:58.761869907 CEST	49733	80	192.168.2.4	208.95.112.1
May 23, 2024 15:14:59.857954979 CEST	49733	80	192.168.2.4	208.95.112.1
May 23, 2024 15:14:59.865355968 CEST	80	49733	208.95.112.1	192.168.2.4
May 23, 2024 15:14:59.865426064 CEST	49733	80	192.168.2.4	208.95.112.1
May 23, 2024 15:15:00.109622955 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:00.114650965 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:00.114732027 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:00.707441092 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:00.707745075 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:00.763441086 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:00.825196981 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:00.825453043 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:00.830365896 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:00.942614079 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:00.943167925 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:00.948102951 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.064224005 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.065455914 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.065522909 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.069269896 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.069279909 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.069331884 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.085501909 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.116055965 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.116123915 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.121002913 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.225574970 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.228625059 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.276777983 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.422039986 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.437019110 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.442173958 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.574803114 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.575198889 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.581516981 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.835691929 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.836100101 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.841353893 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.948579073 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:01.949039936 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:01.958311081 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.075952053 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.076473951 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:02.086052895 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.193198919 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.194154978 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:02.194206953 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:02.194221973 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:02.194242001 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:15:02.204132080 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.208956003 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.209008932 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.209060907 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.312308073 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:15:02.355657101 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:39.887504101 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:39.921252012 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:16:40.023904085 CEST	587	49734	192.185.143.105	192.168.2.4
May 23, 2024 15:16:40.024420023 CEST	49734	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:43.727264881 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:43.732188940 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:43.732265949 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:44.396500111 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.396652937 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:44.402477026 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.539321899 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.539949894 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:44.544846058 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.656542063 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.657021046 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:44.668224096 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.789745092 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.791134119 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.794641018 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.794796944 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:44.797801971 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:44.855568886 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.965368032 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:44.970998049 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.020560980 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.171302080 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.171669960 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.176538944 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.287921906 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.288178921 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.293122053 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.524960995 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.525141954 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.530133963 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.639410019 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.639626026 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.644589901 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.777327061 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.787616968 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.792623997 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.901881933 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.920559883 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.920728922 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.920815945 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.920958042 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.923688889 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.925514936 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.925569057 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.933240891 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.933249950 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.933258057 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.933265924 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.933269024 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.933410883 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.938047886 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.938056946 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.938065052 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.938067913 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.938071012 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.938077927 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.938086033 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.938112020 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.938159943 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.942799091 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.942862988 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.948345900 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.948357105 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.948364973 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.948371887 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.948379040 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.948405027 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.948437929 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.953131914 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.953140020 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.953147888 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.953222036 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.953241110 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.961071968 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.961081982 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.961174011 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.965832949 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.965841055 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.965851068 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.965862036 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.965892076 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.965917110 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:45.972009897 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972014904 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972018003 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972026110 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972029924 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972033024 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972045898 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972054005 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972063065 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972069979 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972079039 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972086906 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972095013 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.972103119 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.976955891 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.976965904 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.976972103 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.976979017 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.976988077 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.976994991 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:45.977003098 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.012275934 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:46.017195940 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.017210007 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.067437887 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.300647020 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.355933905 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:46.689241886 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:46.697299004 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.805128098 CEST	587	64310	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.805789948 CEST	64310	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:46.809988022 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:46.860251904 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:46.860446930 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:47.479321003 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:47.479827881 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:47.484785080 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:47.594204903 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:47.652842999 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:47.800262928 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:47.805496931 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:47.916765928 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:47.917188883 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:47.922250986 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:48.050646067 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:48.052891016 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:48.052939892 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:48.058696032 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:48.060420036 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:48.106120110 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:48.216521978 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:48.277817965 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:49.477814913 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:49.482861996 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:49.596838951 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:49.597246885 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:49.604101896 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:49.715307951 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:49.717408895 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:49.724510908 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:49.847898006 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:49.862778902 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:49.868788958 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.008234978 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.010950089 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.017793894 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.159379959 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.159650087 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.164589882 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.275930882 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.276249886 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.276309013 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.276360035 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.276434898 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.277671099 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.281194925 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.281271935 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.286055088 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286067963 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286084890 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286096096 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286104918 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286118031 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286127090 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286137104 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286142111 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.286144972 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286154032 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.286175013 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.286186934 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.286200047 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.286247969 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.290906906 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.291023970 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.295692921 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295706987 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295715094 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295728922 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295738935 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295747995 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295752048 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295759916 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.295787096 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.295823097 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.295850039 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.300446987 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.300457001 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.300643921 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.305526972 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305537939 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305546999 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305556059 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305563927 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305574894 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305588007 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305598021 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305607080 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.305610895 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:50.305618048 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311122894 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311135054 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311142921 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311151028 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311166048 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311175108 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311182022 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311191082 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.311198950 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.315846920 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.315857887 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.315865993 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.315879107 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.315887928 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.315896034 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.363301039 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.600188971 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:50.699959040 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:52.884596109 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:52.893249035 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.019778967 CEST	587	64311	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.023416996 CEST	64311	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:53.024502993 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:53.085539103 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.087337017 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:53.651254892 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.651408911 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:53.656342983 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.776645899 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.776813030 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:53.785034895 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.896958113 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:53.897480965 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:53.902977943 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.025933027 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.027334929 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.027374983 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.030801058 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.037483931 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.084261894 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.192486048 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.193674088 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.201446056 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.309587002 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.309850931 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.314762115 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.425486088 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.425766945 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.430721998 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.541399002 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.541598082 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.546540976 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.658204079 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.658497095 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.668153048 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.787369013 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.787628889 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.794182062 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.902261972 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.902740955 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.902740955 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.902740955 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.903002024 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.907027960 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.907697916 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.907879114 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.912497044 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.912508965 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.912518978 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.912528038 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.912535906 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.912545919 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.912691116 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.912691116 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.917367935 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.917452097 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.922139883 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.922151089 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.922267914 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.927181959 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.927238941 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.927515030 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.932060957 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.932094097 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.932121992 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.932149887 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.932152033 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:16:54.932178020 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.932207108 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.936872959 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.936903954 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.936932087 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.936959982 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.936989069 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.937017918 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.937046051 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.937131882 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.941641092 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.941670895 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.941698074 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.941725969 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:54.985338926 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:55.230340004 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:16:55.434151888 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:08.936897993 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:09.234507084 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:09.591008902 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:09.895410061 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:17:09.901766062 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:17:09.901787996 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:17:10.002594948 CEST	587	64312	192.185.143.105	192.168.2.4
May 23, 2024 15:17:10.003140926 CEST	64312	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:10.004336119 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:10.013463020 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:10.013546944 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:10.672323942 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:10.672744989 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:10.680797100 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:10.872759104 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:10.873032093 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:10.880935907 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:10.998703003 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.002553940 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.010612011 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.137636900 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.139303923 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.139564991 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.142919064 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.145880938 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.155679941 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.159027100 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.164433002 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.282625914 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.287153006 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.292237997 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.405637980 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.406472921 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.411544085 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.525867939 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.526509047 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.531984091 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.765208006 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.765424967 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.771644115 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.884622097 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:11.884905100 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:11.889893055 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.010660887 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.012155056 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.019284010 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.132543087 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.133994102 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.134109974 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.134222031 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.134313107 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.139709949 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.140254974 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.145612001 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194118023 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194174051 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194205046 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194232941 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194231987 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194262028 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194272041 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194288015 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194291115 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194303036 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194319963 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194339037 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194348097 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194375038 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194376945 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194386005 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194405079 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194423914 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194433928 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194454908 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194469929 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.194523096 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.194578886 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.205986977 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.206047058 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.210963011 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.210992098 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.211019993 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.211019993 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.211045027 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.211050034 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.211064100 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.211114883 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.215786934 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.215840101 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220586061 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220616102 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220643044 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220647097 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220668077 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220670938 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220695972 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220698118 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220724106 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220726013 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220748901 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220753908 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220776081 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220782042 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220803022 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220808983 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.220829964 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.220849037 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.225357056 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.225388050 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.225414991 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.225415945 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:12.226511955 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226541996 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226569891 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226598024 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226624966 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226651907 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226679087 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226706028 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226732969 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226759911 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226788044 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226814032 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226840973 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226870060 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226896048 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226922989 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226948977 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.226977110 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.227004051 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.227034092 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.227061033 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.230143070 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.234951973 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.234980106 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.235007048 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.248203993 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.487757921 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:12.684567928 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:19.419008017 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:19.454317093 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:19.563782930 CEST	587	64313	192.185.143.105	192.168.2.4
May 23, 2024 15:17:19.564408064 CEST	64313	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:19.565408945 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:19.575021029 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:19.575530052 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.205591917 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.205835104 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.220541000 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.353646994 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.359181881 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.366559982 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.475250006 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.479484081 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.484596968 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.620670080 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.622728109 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.622833967 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.627579927 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.628796101 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.676676989 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.810839891 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.813076019 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.818229914 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.929534912 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:20.933068991 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:20.938797951 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.083518982 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.087317944 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.096491098 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.208025932 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.210681915 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.216387987 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.325083971 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.325303078 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.332843065 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.461936951 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.462251902 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.468177080 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.728105068 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.728475094 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.728545904 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.728607893 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.728712082 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.730436087 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.737324953 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.737387896 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783462048 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783514977 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783544064 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783636093 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783654928 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783663034 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783688068 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783709049 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783727884 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783736944 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783755064 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783765078 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783785105 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783792973 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783817053 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783821106 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783842087 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783873081 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783873081 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783900023 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.783917904 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.783952951 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.790359020 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.790415049 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.847600937 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.847675085 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.847678900 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.847708941 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.847733974 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.847796917 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.852144957 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.852247000 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.856990099 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.857018948 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.857044935 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.857053995 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.857070923 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.857083082 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.857125044 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.857146025 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.872420073 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.872490883 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:21.877865076 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.882658958 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.882688999 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.882718086 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.882745028 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.882772923 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.882800102 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.931621075 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:21.931644917 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:22.067301035 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:22.185978889 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:29.531433105 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:29.545619965 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:29.667495012 CEST	587	64314	192.185.143.105	192.168.2.4
May 23, 2024 15:17:29.668004036 CEST	64314	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:29.670514107 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:29.726735115 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:29.726835012 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:30.300381899 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.300584078 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:30.305516958 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.435539007 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.435772896 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:30.491030931 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.555094004 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.555602074 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:30.560681105 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.690963030 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.692662954 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.694384098 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:30.696180105 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.702510118 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:30.744575024 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.908611059 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:30.911478043 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:30.916507959 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.051141024 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.053205967 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.058271885 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.173125982 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.173496008 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.196033955 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.296473980 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.296850920 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.301959038 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.427299976 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.435162067 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.440237999 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.618089914 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.621361017 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.629096031 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.753602982 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.753956079 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.753978014 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.754051924 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.754051924 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.759094000 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.761007071 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.761101961 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.770207882 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.770236015 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.770250082 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.770275116 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.770287991 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.770320892 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.770320892 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.770411015 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.804549932 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.804696083 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.824250937 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.824409962 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.847012997 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847028971 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847042084 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847053051 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847068071 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847079992 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847084045 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.847084045 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:31.847094059 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847105980 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847119093 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847131014 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847143888 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847157001 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847168922 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847173929 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847177982 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847182989 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847187996 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847192049 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847197056 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.847208977 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.853883028 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859555960 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859570026 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859581947 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859601974 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859615088 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859627008 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859641075 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.859653950 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.886826992 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:31.886842966 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:32.120671988 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:32.231089115 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.104425907 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.110560894 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:51.227710962 CEST	587	64315	192.185.143.105	192.168.2.4
May 23, 2024 15:17:51.233119965 CEST	64315	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.254914045 CEST	64316	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.296492100 CEST	587	64316	192.185.143.105	192.168.2.4
May 23, 2024 15:17:51.296577930 CEST	64316	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.750508070 CEST	64316	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.756938934 CEST	587	64316	192.185.143.105	192.168.2.4
May 23, 2024 15:17:51.757323980 CEST	64316	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.798755884 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:51.812180996 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:51.812273026 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.325234890 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.325510025 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.332523108 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.439522982 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.440138102 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.445086002 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.558388948 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.558825016 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.567452908 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.688987017 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.689563990 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.689651966 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.694901943 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.696814060 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.710056067 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.710133076 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.728146076 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.850538969 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:52.851522923 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:52.874623060 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.002675056 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.002896070 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.021944046 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.132549047 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.132807970 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.187153101 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.462085009 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.462327003 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.468004942 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.577410936 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.577651024 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.582576036 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.702528000 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.710545063 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.715754032 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.825046062 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.841191053 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.846216917 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.850866079 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.850866079 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.851052999 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.855875969 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.860013008 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.860786915 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865550041 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865561962 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865571022 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865581989 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865592003 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865601063 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865611076 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865621090 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865639925 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.865643024 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.865643024 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.865670919 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.865696907 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.870575905 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.870630026 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.877985001 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.878098965 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.883136988 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.883474112 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.888359070 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888371944 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888381004 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888391018 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888401031 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888411045 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888421059 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888431072 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888437033 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.888439894 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888449907 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888459921 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888470888 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.888477087 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:17:53.888480902 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.893107891 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.893122911 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.893132925 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898190975 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898205042 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898214102 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898225069 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898232937 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898241997 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898252010 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898268938 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898278952 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898288012 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898297071 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898307085 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898319006 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898328066 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.898336887 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:53.947298050 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:54.188080072 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:17:54.231194973 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:01.192770004 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:01.206065893 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:18:01.318979979 CEST	587	64317	192.185.143.105	192.168.2.4
May 23, 2024 15:18:01.323626995 CEST	64317	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:01.326199055 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:01.378804922 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:01.382808924 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:01.918278933 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:01.918392897 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:01.923336983 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.032111883 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.032299042 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.037370920 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.146351099 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.146965981 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.152272940 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.277090073 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.280550957 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.280599117 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.282772064 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.282778978 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.282869101 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.284511089 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.331296921 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.331567049 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.337215900 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.441219091 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.446504116 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.451952934 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.559305906 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.559706926 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.568300009 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.677892923 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.678227901 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.683237076 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.793832064 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.794056892 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.799020052 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.906920910 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:02.907607079 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:02.912684917 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.027193069 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.031328917 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.036448002 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.149343967 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.160475969 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.160604000 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.160660982 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.161077023 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.163239956 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.165421009 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.166270971 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.171492100 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171497107 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171506882 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171511889 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171520948 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171525002 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171530008 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171535015 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.171644926 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.176453114 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.178555012 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.184036016 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184048891 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184052944 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184061050 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184063911 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184068918 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184078932 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184082985 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.184201002 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.184241056 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.188822031 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.188827038 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.190643072 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.193609953 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193614006 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193624973 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193629026 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193639040 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193641901 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193645954 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193655968 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193659067 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193662882 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193671942 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193675995 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193686008 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193689108 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193694115 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.193698883 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193702936 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193712950 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193717003 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193726063 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.193728924 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.198587894 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.198599100 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.198612928 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.198617935 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.198621988 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.198633909 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.203351021 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.203356981 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.203371048 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.203376055 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.203386068 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.203389883 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.251981974 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.481517076 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.613888025 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.627490997 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.664884090 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.771787882 CEST	587	64318	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.772330999 CEST	64318	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.773497105 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:03.824523926 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:03.824609041 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:04.482768059 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.483063936 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:04.492430925 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.613015890 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.615308046 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:04.620261908 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.733030081 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.734903097 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:04.740062952 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.865344048 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.865442991 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.865767956 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:04.870871067 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.872750998 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:04.878182888 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.992319107 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:04.996038914 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.001024961 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.110342979 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.110796928 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.115741014 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.243819952 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.245476007 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.250417948 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.363178015 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.363650084 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.373066902 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.482368946 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.482635021 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.488066912 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.605309010 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.606437922 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.611357927 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.743545055 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.743912935 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.743998051 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.744056940 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.744102001 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.745469093 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.748892069 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.748938084 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.753715038 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.753729105 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.753741980 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.753755093 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.753767014 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.753779888 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.753781080 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.753803968 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.753803968 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.753823042 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.753845930 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.760941982 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.760989904 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.768217087 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.768230915 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.768273115 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.768313885 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.773101091 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.773159027 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.778013945 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.778027058 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.778039932 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.778053045 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.778065920 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.778067112 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.778065920 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.778079987 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.778093100 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.778096914 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.778105974 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.782748938 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.782762051 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.782773972 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.782787085 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.782799006 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.782810926 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.782824039 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787487030 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787499905 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787512064 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787524939 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787537098 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787549019 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787564039 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787576914 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.787581921 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.809359074 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:05.814358950 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.814380884 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:05.859318972 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:06.112976074 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:06.153022051 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:12.026309013 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:12.064690113 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:12.176249027 CEST	587	64319	192.185.143.105	192.168.2.4
May 23, 2024 15:18:12.176734924 CEST	64319	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:12.177618980 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:12.229707003 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:12.229789972 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:12.823180914 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:12.871948957 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:12.935652971 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:12.940829992 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.048638105 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.050879955 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:13.055876970 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.166831970 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.174062014 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:13.179219007 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.301402092 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.302377939 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.306159019 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.306178093 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.306205034 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:13.309648037 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:13.347729921 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:13.354402065 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:14.642955065 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:14.648014069 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:14.755819082 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:14.756742954 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:14.761671066 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:14.887473106 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:14.887839079 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:14.892750978 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.002155066 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.002422094 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.012108088 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.145827055 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.146044970 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.154392004 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.266856909 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.267091990 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.276942968 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.401601076 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.402726889 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.410062075 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.515208006 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.515630960 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.515718937 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.515759945 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.517021894 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.517021894 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.521028042 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.521246910 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.526020050 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526026011 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526035070 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526038885 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526047945 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526051998 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526061058 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526065111 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526072979 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.526169062 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.530963898 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.535903931 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.535908937 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.535918951 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.535922050 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.535931110 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.535933971 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.535938025 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.536134005 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.541479111 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.546489954 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.546503067 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.546641111 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.546675920 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:15.560481071 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561110020 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561114073 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561124086 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561126947 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561131001 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561134100 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561136961 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561140060 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561144114 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561146975 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561150074 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561157942 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561161995 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561172962 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561177015 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561188936 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561197042 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561201096 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561203957 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561212063 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.561216116 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.568845987 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.573870897 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.573875904 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.838562012 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:15.981210947 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:36.064848900 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:36.069871902 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:36.177439928 CEST	587	64320	192.185.143.105	192.168.2.4
May 23, 2024 15:18:36.177946091 CEST	64320	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:36.181119919 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:36.232536077 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:36.232647896 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:36.761584997 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:36.761774063 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:36.766722918 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:36.877219915 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:36.877370119 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:36.882445097 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.004580021 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.005064964 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.009957075 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.136159897 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.137310028 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.137375116 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.140901089 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.140918970 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.140978098 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.142182112 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.192214012 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.192326069 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.198566914 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.303345919 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.304217100 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.309307098 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.419867992 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.420135975 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.425461054 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.537884951 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.538737059 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.543674946 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.774812937 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.775104046 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.780981064 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.903587103 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:37.905661106 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:37.959409952 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.032196045 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.035100937 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.040163040 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.150158882 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.178091049 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.178091049 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.178164005 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.178164005 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.183078051 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.191582918 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.196270943 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.201373100 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.201383114 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.201519012 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.206228018 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206235886 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206245899 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206249952 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206253052 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206262112 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206264973 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206268072 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206275940 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.206322908 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.206360102 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.212131023 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.212219954 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.219984055 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.219993114 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.219996929 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.220000982 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.220117092 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.220153093 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.224777937 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.224801064 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.225275040 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.229604006 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229613066 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229621887 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229625940 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229634047 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229638100 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229646921 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229650974 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229657888 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229661942 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229670048 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229672909 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229676008 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229680061 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229684114 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229688883 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229696035 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229698896 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229707956 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.229721069 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:38.234384060 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234391928 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234395981 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234399080 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234406948 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234411001 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234419107 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234422922 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.234433889 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.239203930 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.239212990 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.239223957 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.239227057 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.291393995 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.524033070 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:38.574997902 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:46.679604053 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:46.684587955 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:46.797693014 CEST	587	64321	192.185.143.105	192.168.2.4
May 23, 2024 15:18:46.802598953 CEST	64321	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:46.815246105 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:46.856707096 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:46.856797934 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:47.419329882 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.419615984 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:47.424557924 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.538628101 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.538777113 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:47.544224024 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.654336929 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.654767036 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:47.659971952 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.784867048 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.785772085 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.789613962 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.789659023 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:47.827295065 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:47.876352072 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.981647968 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:47.983257055 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:47.988286018 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.096546888 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.097074032 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:48.102560997 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.213695049 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.279258013 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:48.351258039 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:48.356393099 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.466984034 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.487433910 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:48.492403030 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.615417004 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.615710020 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:48.620687008 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.742269039 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:48.965714931 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:49.907417059 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:49.961122036 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.068026066 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.068587065 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.068674088 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.068710089 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.068850994 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.070636034 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.073664904 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.073724031 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.078607082 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078619003 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078627110 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078636885 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078663111 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078670979 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078679085 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078685999 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078691006 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.078695059 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078702927 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078711033 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.078774929 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.078800917 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.083293915 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.083340883 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.088121891 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088131905 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088139057 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088150024 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088157892 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088165998 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088169098 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.088175058 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088182926 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088192940 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.088207960 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.088238955 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.088238955 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.088275909 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.092880964 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.092952013 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.097683907 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097697973 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097706079 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097709894 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097712994 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097716093 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097729921 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097737074 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.097738028 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097747087 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097755909 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.097755909 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.097767115 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:50.102634907 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151374102 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151391983 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151395082 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151398897 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151401997 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151411057 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151418924 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151426077 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151434898 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151443005 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.151465893 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.383413076 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:50.481372118 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:59.854729891 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:59.859761000 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:59.967170954 CEST	587	64322	192.185.143.105	192.168.2.4
May 23, 2024 15:18:59.967688084 CEST	64322	587	192.168.2.4	192.185.143.105
May 23, 2024 15:18:59.968872070 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:00.024697065 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.024806976 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:00.560369015 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.560921907 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:00.604724884 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.714767933 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.714947939 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:00.719842911 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.831810951 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.832242966 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:00.842926979 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.969624043 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.969938993 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.970030069 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:00.974390030 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:00.975939035 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:01.025007963 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.134629011 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.138516903 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:01.143649101 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.256230116 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.256414890 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:01.261302948 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.370958090 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.371385098 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:01.378712893 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.492435932 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.492790937 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:01.497818947 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.609946012 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.610194921 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:01.615178108 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.734253883 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:01.793824911 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:03.633025885 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:03.633852959 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:03.637959957 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:03.670751095 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:03.687338114 CEST	587	64323	192.185.143.105	192.168.2.4
May 23, 2024 15:19:03.687406063 CEST	64323	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:03.692662001 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:03.692744017 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.269988060 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.270509005 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.275432110 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.383013010 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.383297920 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.388832092 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.504089117 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.505023003 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.515733957 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.639226913 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.639245033 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.639342070 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.646449089 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.646461964 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.646522999 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.647882938 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.700833082 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.808499098 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.809246063 CEST	64324	587	192.168.2.4	192.185.143.105
May 23, 2024 15:19:04.814162970 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.921921968 CEST	587	64324	192.185.143.105	192.168.2.4
May 23, 2024 15:19:04.965734959 CEST	64324	587	192.168.2.4	192.185.143.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 15:14:57.248487949 CEST	59451	53	192.168.2.4	1.1.1.1
May 23, 2024 15:14:57.258470058 CEST	53	59451	1.1.1.1	192.168.2.4
May 23, 2024 15:14:58.164367914 CEST	61153	53	192.168.2.4	1.1.1.1
May 23, 2024 15:14:58.210863113 CEST	53	61153	1.1.1.1	192.168.2.4
May 23, 2024 15:14:59.859242916 CEST	57528	53	192.168.2.4	1.1.1.1
May 23, 2024 15:15:00.108640909 CEST	53	57528	1.1.1.1	192.168.2.4
May 23, 2024 15:15:17.925806046 CEST	53	64854	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 15:14:57.248487949 CEST	192.168.2.4	1.1.1.1	0x8ea	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:58.164367914 CEST	192.168.2.4	1.1.1.1	0xfddc	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:59.859242916 CEST	192.168.2.4	1.1.1.1	0x714b	Standard query (0)	mail.alitextile.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 23, 2024 15:14:57.258470058 CEST	1.1.1.1	192.168.2.4	0x8ea	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:57.258470058 CEST	1.1.1.1	192.168.2.4	0x8ea	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:57.258470058 CEST	1.1.1.1	192.168.2.4	0x8ea	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:58.210863113 CEST	1.1.1.1	192.168.2.4	0xfddc	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
May 23, 2024 15:15:00.108640909 CEST	1.1.1.1	192.168.2.4	0x714b	No error (0)	mail.alitextile.com	192.185.143.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	208.95.112.1	80	6972	C:\Users\user\Desktop\PO_23052024.exe

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 15:14:58.218795061 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 23, 2024 15:14:58.720228910 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 13:14:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.26.12.205	443	6972	C:\Users\user\Desktop\PO_23052024.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 13:14:57 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-23 13:14:58 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 13:14:58 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88854fe08e5d8c45-EWR
2024-05-23 13:14:58 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 23, 2024 15:15:00.707441092 CEST	587	49734	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:15:00 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:15:00.707745075 CEST	49734	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:15:00.825196981 CEST	587	49734	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:15:00.825453043 CEST	49734	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:15:00.942614079 CEST	587	49734	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:16:44.396500111 CEST	587	64310	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:16:44 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:16:44.396652937 CEST	64310	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:16:44.539321899 CEST	587	64310	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:16:44.539949894 CEST	64310	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:16:44.656542063 CEST	587	64310	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:16:47.479321003 CEST	587	64311	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:16:47 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:16:47.479827881 CEST	64311	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:16:47.594204903 CEST	587	64311	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:16:47.800262928 CEST	64311	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:16:47.916765928 CEST	587	64311	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:16:53.651254892 CEST	587	64312	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:16:53 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:16:53.651408911 CEST	64312	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:16:53.776645899 CEST	587	64312	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:16:53.776813030 CEST	64312	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:16:53.896958113 CEST	587	64312	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:17:10.672323942 CEST	587	64313	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:17:10 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:10.672744989 CEST	64313	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:17:10.872759104 CEST	587	64313	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:17:10.873032093 CEST	64313	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:17:10.998703003 CEST	587	64313	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:17:20.205591917 CEST	587	64314	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:17:20 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:20.205835104 CEST	64314	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:17:20.353646994 CEST	587	64314	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:17:20.359181881 CEST	64314	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:17:20.475250006 CEST	587	64314	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:17:30.300381899 CEST	587	64315	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:17:30 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:30.300584078 CEST	64315	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:17:30.435539007 CEST	587	64315	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:17:30.435772896 CEST	64315	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:17:30.555094004 CEST	587	64315	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:17:52.325234890 CEST	587	64317	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:17:52 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:52.325510025 CEST	64317	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:17:52.439522982 CEST	587	64317	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:17:52.440138102 CEST	64317	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:17:52.558388948 CEST	587	64317	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:18:01.918278933 CEST	587	64318	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:18:01 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:01.918392897 CEST	64318	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:18:02.032111883 CEST	587	64318	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:18:02.032299042 CEST	64318	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:18:02.146351099 CEST	587	64318	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:18:04.482768059 CEST	587	64319	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:18:04 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:04.483063936 CEST	64319	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:18:04.613015890 CEST	587	64319	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:18:04.615308046 CEST	64319	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:18:04.733030081 CEST	587	64319	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:18:12.823180914 CEST	587	64320	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:18:12 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:12.935652971 CEST	64320	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:18:13.048638105 CEST	587	64320	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:18:13.050879955 CEST	64320	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:18:13.166831970 CEST	587	64320	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:18:36.761584997 CEST	587	64321	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:18:36 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:36.761774063 CEST	64321	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:18:36.877219915 CEST	587	64321	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:18:36.877370119 CEST	64321	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:18:37.004580021 CEST	587	64321	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:18:47.419329882 CEST	587	64322	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:18:47 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:47.419615984 CEST	64322	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:18:47.538628101 CEST	587	64322	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:18:47.538777113 CEST	64322	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:18:47.654336929 CEST	587	64322	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:19:00.560369015 CEST	587	64323	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:19:00 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:19:00.560921907 CEST	64323	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:19:00.714767933 CEST	587	64323	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:19:00.714947939 CEST	64323	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:19:00.831810951 CEST	587	64323	192.185.143.105	192.168.2.4	220 TLS go ahead
May 23, 2024 15:19:04.269988060 CEST	587	64324	192.185.143.105	192.168.2.4	220-cutlass.websitewelcome.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 08:19:04 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:19:04.270509005 CEST	64324	587	192.168.2.4	192.185.143.105	EHLO 715575
May 23, 2024 15:19:04.383013010 CEST	587	64324	192.185.143.105	192.168.2.4	250-cutlass.websitewelcome.com Hello 715575 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 23, 2024 15:19:04.383297920 CEST	64324	587	192.168.2.4	192.185.143.105	STARTTLS
May 23, 2024 15:19:04.504089117 CEST	587	64324	192.185.143.105	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	09:14:53
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\PO_23052024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO_23052024.exe"
Imagebase:	0xfc0000
File size:	924'168 bytes
MD5 hash:	23626A822AFB45C288ACF9FABBEF5AD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1653270109.0000000004469000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1653270109.00000000046D6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:14:55
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\PO_23052024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO_23052024.exe"
Imagebase:	0xcb0000
File size:	924'168 bytes
MD5 hash:	23626A822AFB45C288ACF9FABBEF5AD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4100635153.000000000320D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4098049822.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	9

Executed Functions

Function 0172D449 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0172D4D6
GetCurrentThread.KERNEL32 ref: 0172D513
GetCurrentProcess.KERNEL32 ref: 0172D550
GetCurrentThreadId.KERNEL32 ref: 0172D5A9

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3418dd0a61c50525161301accaffebfc26b68cc01318fd61b7da8f1530679773
Instruction ID: 0c6b0c7fa16e56a887623d75faee6d5121dc92dc2195942fe8b733c2de155e8b
Opcode Fuzzy Hash: 3418dd0a61c50525161301accaffebfc26b68cc01318fd61b7da8f1530679773
Instruction Fuzzy Hash: B95157B09002198FDB14DFAAD548BDEBBF1EF88304F248469E419BB260DB749945CF65

Function 0172D458 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0172D4D6
GetCurrentThread.KERNEL32 ref: 0172D513
GetCurrentProcess.KERNEL32 ref: 0172D550
GetCurrentThreadId.KERNEL32 ref: 0172D5A9

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e31787c35a0eda0fdd44378b740b7d9eb5c272468b8a4ab212cc4c3d67b3adc3
Instruction ID: 911d067e919e346a46b8ac31f2b8c326975ed7a12fe5b76b9db28328078f7ce3
Opcode Fuzzy Hash: e31787c35a0eda0fdd44378b740b7d9eb5c272468b8a4ab212cc4c3d67b3adc3
Instruction Fuzzy Hash: 5B5128B09002198FDB14DFAAD548B9EFBF1FB88314F20C459E419BB260DB749945CF65

Function 0172ADC8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0172B01E

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 59e2bc769e6fbeb171efd6c11e069abddaf475e8c276a23b6eae0046ab116219
Instruction ID: 010ac09e75d7f666cd0475db51a1c944698aebfd258eebc22e71e16791824ba5
Opcode Fuzzy Hash: 59e2bc769e6fbeb171efd6c11e069abddaf475e8c276a23b6eae0046ab116219
Instruction Fuzzy Hash: 04712270A00B158FEB24DF29D44575ABBF1FF88304F108A2DD48ADBA50DB75E84ACB91

Function 0172590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017259C9

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e19f3b2a5e72fcfb3bb464b858b7a929ff01cbd8203afa505cef31c9d65581b8
Instruction ID: b85272d53a87c68e97cbbd1278766cd626335443260e7798503f67e38ffbf4b3
Opcode Fuzzy Hash: e19f3b2a5e72fcfb3bb464b858b7a929ff01cbd8203afa505cef31c9d65581b8
Instruction Fuzzy Hash: A441E0B0C00629CFDB24CFAAC885ADDBBB5BF49304F24806AD409AB255DBB55946CF90

Function 0172449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017259C9

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4f9ef82e6440675bd419321c81adc37b0c143da5d266a0a6c06e04ce354dec5c
Instruction ID: 956403e2fb3cd15d0e5d822036009f47c2788ac0471d6c9d2395a89b90b68087
Opcode Fuzzy Hash: 4f9ef82e6440675bd419321c81adc37b0c143da5d266a0a6c06e04ce354dec5c
Instruction Fuzzy Hash: 0A41E1B0D00729CBDB24DFAAC844BDDBBB5BF49304F24806AD408AB255DBB55946CF90

Function 0172D698 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0172D727

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2f1fe26bbda0db152ff3bbcf914382d162f7a6e8a0479fc5c0fb3fe631fccac7
Instruction ID: e71d2b2d27c45b894eed85bdb4c7a69d2ed2efcad8741b5f89d8e035599f2e29
Opcode Fuzzy Hash: 2f1fe26bbda0db152ff3bbcf914382d162f7a6e8a0479fc5c0fb3fe631fccac7
Instruction Fuzzy Hash: CC21E3B59002589FDB10CFAAD584ADEFFF5EB48320F14841AE954A7310D378A945CFA4

Function 0172D6A0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0172D727

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5517a095cc6e66343da5724b506b79b9a0e8a4a35292b76ea992bb3f3d70a44b
Instruction ID: 14732f92349d2e147677b72161af0be004c3c3c2425fa68f2b6bfbd415cc16f3
Opcode Fuzzy Hash: 5517a095cc6e66343da5724b506b79b9a0e8a4a35292b76ea992bb3f3d70a44b
Instruction Fuzzy Hash: A021C4B59002589FDB10CF9AD584ADEFFF4EB48310F14841AE954A7350D378A954CFA5

Function 0172A188 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0172B099,00000800,00000000,00000000), ref: 0172B2AA

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 025fc7d7533d65db7d591349e69bc8f1afebc275047c3bc043a58f30d529899f
Instruction ID: 70fff56a51d65b6342199b2f4c775b89c00fa54b4efa8d8669c4d323e8cf85c9
Opcode Fuzzy Hash: 025fc7d7533d65db7d591349e69bc8f1afebc275047c3bc043a58f30d529899f
Instruction Fuzzy Hash: 231123B69043198FDB20CF9AC444BDEFBF4EB89320F10842AE519AB210C375A945CFA4

Function 0172B238 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0172B099,00000800,00000000,00000000), ref: 0172B2AA

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6298193b769281ab7f6bcefc6107d707d7a6e14d53250b97e2a53c62164c0b1b
Instruction ID: f18021614d655ed7cffc5242597b38dcf78e3541cc1b9461f17a1cd1a87c0967
Opcode Fuzzy Hash: 6298193b769281ab7f6bcefc6107d707d7a6e14d53250b97e2a53c62164c0b1b
Instruction Fuzzy Hash: 4D2114B69043598FDB20CFAAD884BDEFBF4EB88310F14842AD459A7210C375A546CFA5

Function 0172AFB8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0172B01E

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f3eb78995c7d7326054a213dc6242a26f9c57d3775b1f0bb5bec1430e52c6a18
Instruction ID: aeb5dbb61b86bb292ee07c7d3984a6e88bfcbb28d83095c5c3b5a4dc309b1198
Opcode Fuzzy Hash: f3eb78995c7d7326054a213dc6242a26f9c57d3775b1f0bb5bec1430e52c6a18
Instruction Fuzzy Hash: AC1110B5C003598FDB20CF9AD444BDEFBF4EB88324F14842AD528A7210D379A545CFA1

Function 0158D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651826693.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_158d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966e33e54cb8a01019913d3bdbe876e041b513ae36baa51e6b4ca6244e6f0d90
Instruction ID: 0ddb5630805f271ff0464d402fef99fc45c0ad6d38a4d0b76c7aae070761a9ea
Opcode Fuzzy Hash: 966e33e54cb8a01019913d3bdbe876e041b513ae36baa51e6b4ca6244e6f0d90
Instruction Fuzzy Hash: 4A21F472504204DFDB06EF98D9C4B2ABFF5FB88320F20C569E9065E296C336D416CBA1

Function 0158D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651826693.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_158d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fad40844872c349c984de2bb0245abcd3a28e4f9594c3262b0c342d0ebdf3eb
Instruction ID: d2d28d36e8159dd8e8cc71a2703986964778df94d9aa4d08b27863317cc8d071
Opcode Fuzzy Hash: 9fad40844872c349c984de2bb0245abcd3a28e4f9594c3262b0c342d0ebdf3eb
Instruction Fuzzy Hash: 3A214871100204DFDB01EF48D9C0B5ABFF5FB84324F20C569D9091F2A6C376E446C6A1

Function 0159D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651997750.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_159d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e6e9c297b11e33f1e582f025835e8a7dba1fe33c07860a628e2e7df772f263
Instruction ID: 00dfbe48ba87d42ea57407b0dffe9910d865167b8039cd5d593a6a31dea570b3
Opcode Fuzzy Hash: b3e6e9c297b11e33f1e582f025835e8a7dba1fe33c07860a628e2e7df772f263
Instruction Fuzzy Hash: 2B210071604200DFDF15DF68D984B2ABBB5FB84354F20C969D80A4F256D33AD446CA62

Function 0159D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651997750.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_159d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f175dc31adaa1ed8147230e0421d10199baad82a2383d2e4fa16ca46816fe51
Instruction ID: 984a775e48c46cb2318fb3b499445bcc9df67e4264e17f26c72b421331ae5429
Opcode Fuzzy Hash: 4f175dc31adaa1ed8147230e0421d10199baad82a2383d2e4fa16ca46816fe51
Instruction Fuzzy Hash: 0A212971504200DFDF05DF98D6C0B2ABBB5FB84324F24C9ADD9094F296C33AD446CA62

Function 0159D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651997750.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_159d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad12d037e148dd97e183e04848247494c9e249270dc2dec521abfcd6f1db811e
Instruction ID: 07e1db9252aba8b810ec0cf09e98012d91cc805873e04b90b2a0c6060f6e1bd2
Opcode Fuzzy Hash: ad12d037e148dd97e183e04848247494c9e249270dc2dec521abfcd6f1db811e
Instruction Fuzzy Hash: 5B219D755093808FDB03CF64D994B15BF71FB46214F28C5EAD8498F2A7C33A980ACB62

Function 0158D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651826693.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_158d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 09a11bfbc23a3f31cc84c8cf87740bc43125d6693a79a8d135224ea273a5c156
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: CC21CD76504244CFDB06DF44D9C4B1ABFB2FB84324F24C2A9DD094E296C33AD42ACBA1

Function 0158D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651826693.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_158d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 26258f6d8c2d73a48ad45a1da9cf832650579a4434c286964f599502f2907a6c
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 5311DF72504240DFDB02DF48D5C4B5ABFB1FB94324F24C2A9D9090F266C37AE45ACBA1

Function 0159D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651997750.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_159d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: eaba8be20ddfaaebd46d1c18608070657f01d9fed6d966a8b3b35fa55c8f0ab0
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B6118B75504280DFDF16CF54D5C4B19BFB1FB84224F28C6AAD8494F696C33AD44ACB62

Function 0158D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651826693.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_158d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554b50ff5bc3e4e9c7212e4fb5b340c8deef927f627a56cd8d9317b2caff9b64
Instruction ID: 8157f8ae93e7a2a9f0293d80babb320fa0964486dec50be895f6e9e4c6863d06
Opcode Fuzzy Hash: 554b50ff5bc3e4e9c7212e4fb5b340c8deef927f627a56cd8d9317b2caff9b64
Instruction Fuzzy Hash: 2901AC7110438499E7117E59CD84B5BBFE8FF41364F18C929ED099E1C6D6799440C671

Function 0158D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651826693.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_158d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffcdf02d8867011d2660b24dd773bf1217b4929dea97026efd8252955d64215
Instruction ID: e670a5003e8eec189a427c2fe4ddcbe018f672bc5a1a1a1144c3eb146867d448
Opcode Fuzzy Hash: 6ffcdf02d8867011d2660b24dd773bf1217b4929dea97026efd8252955d64215
Instruction Fuzzy Hash: FFF062715043849AE711AE1AC888B66FFE8EF81634F18C45AED089E287C2799844CAB1

Non-executed Functions

Function 0172D384 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652365295.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1720000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62e311acc5648be99b606803e1e4bfa4fa732ea99a21cfd609f09e44051e29b
Instruction ID: a3479ff8c5943252214da772093db909b0c94f63f8ef12074bdfec4758642eb3
Opcode Fuzzy Hash: a62e311acc5648be99b606803e1e4bfa4fa732ea99a21cfd609f09e44051e29b
Instruction Fuzzy Hash: C3A19136E00229CFCF15DFB4C94499EFBB2FF84300B15816AE906AB265DB75E956CB40

Analysis Process: PO_23052024.exePID: 6972, Parent PID: 6824COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.2%
Total number of Nodes:	270
Total number of Limit Nodes:	24

Executed Functions

Function 02FB7ED0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02FB7F47

Memory Dump Source

Source File: 00000001.00000002.4100120865.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2fb0000_PO_23052024.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 6a9c11688cdda982a77891a32d73e695157b33d4a4e00594f42f9f1c7207aa1e
Instruction ID: 798e3dbccd901786f617adda6a9f6e5bc3c31439c0c165c102307271dc22ee74
Opcode Fuzzy Hash: 6a9c11688cdda982a77891a32d73e695157b33d4a4e00594f42f9f1c7207aa1e
Instruction Fuzzy Hash: B32145B2901259CFCB10CF9AD484BEEFBF4AF49320F14846AE458A3350D738A944CFA4

Function 06EE46D8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,06EE5278,00000000,00000000), ref: 06EE532B

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 054ca36bd4672e3eca80374774859fb7c0c06ce76baa3ac040a6c2d7b283cfbd
Instruction ID: 1c07a4d177d6d1f472f8efb483469b4259e787d6621cc283ce21facc66928af0
Opcode Fuzzy Hash: 054ca36bd4672e3eca80374774859fb7c0c06ce76baa3ac040a6c2d7b283cfbd
Instruction Fuzzy Hash: 292147B1D002098FCB54CF9AC848BEEFBF4EB88314F10842AE459A7350D775A944CFA5

Function 06EE1A78 Relevance: 6.1, APIs: 4, Instructions: 143
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06EE1B16
GetCurrentThread.KERNEL32 ref: 06EE1B53
GetCurrentProcess.KERNEL32 ref: 06EE1B90
GetCurrentThreadId.KERNEL32 ref: 06EE1BE9

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c75cc43b75b90d3b77751a43d2b6860ca0a91ac86e216be069681d181592e38e
Instruction ID: ada52a0eb41b5727b3428a6b8e0714a2205967133719b13380f13a731ad3fb00
Opcode Fuzzy Hash: c75cc43b75b90d3b77751a43d2b6860ca0a91ac86e216be069681d181592e38e
Instruction Fuzzy Hash: 955164B0D00749CFDB44DFAAD948BEEBBF1AF49314F248069E009AB361D7349984CB65

Function 06EE1A98 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06EE1B16
GetCurrentThread.KERNEL32 ref: 06EE1B53
GetCurrentProcess.KERNEL32 ref: 06EE1B90
GetCurrentThreadId.KERNEL32 ref: 06EE1BE9

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5d6ecec3e5b5adc8adeef363240126ef08e9929993fb67cce2969bf28ac83b8d
Instruction ID: b2a3fc20bef3d4f8e11fecff7061823c15a50def39c09a08b8ce7c75bcecf659
Opcode Fuzzy Hash: 5d6ecec3e5b5adc8adeef363240126ef08e9929993fb67cce2969bf28ac83b8d
Instruction Fuzzy Hash: 1E5132B0D00749CFDB54DFAAD948BDEBBF1AB48318F248069E019A7364DB349984CF65

Function 06EE1A97 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06EE1B16
GetCurrentThread.KERNEL32 ref: 06EE1B53
GetCurrentProcess.KERNEL32 ref: 06EE1B90
GetCurrentThreadId.KERNEL32 ref: 06EE1BE9

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7ba1a0bad050d9ddc7065ba0f9d59b3c4795a249d5898d7e8d2022b8e9e82430
Instruction ID: 1205c7ba9b0ff66a7023a5ac165851cf5e88e8dde638f415b603f0caaf6eb595
Opcode Fuzzy Hash: 7ba1a0bad050d9ddc7065ba0f9d59b3c4795a249d5898d7e8d2022b8e9e82430
Instruction Fuzzy Hash: 4A5130B0D00749CFDB44DFAAD948BDEBBF1AB48318F248069E019A7364DB349984CF65

Function 06E8BE40 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.4110123401.0000000006E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e80000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccabf15fba9bcc3edaef2ac4c5b73438c418dbf1f9f0738613613f8d972a1916
Instruction ID: eb0c117e5834b8475f022c2e509f1ea57a8339544ef11d03257d003ef9ebd315
Opcode Fuzzy Hash: ccabf15fba9bcc3edaef2ac4c5b73438c418dbf1f9f0738613613f8d972a1916
Instruction Fuzzy Hash: 23412371E043998FCB14DFB9D80429EBFF1EF89310F1485AAE508A7651DB349845CBD1

Function 06E8F5D8 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06E8F6EA

Memory Dump Source

Source File: 00000001.00000002.4110123401.0000000006E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e80000_PO_23052024.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b58721f686e751385d58201951d012ac8338e383c76a0eee15d14ac86d31de4e
Instruction ID: fffab9d9135cc83d04320047041370a06ff6405f779dd50cf8d36fe77e85c858
Opcode Fuzzy Hash: b58721f686e751385d58201951d012ac8338e383c76a0eee15d14ac86d31de4e
Instruction Fuzzy Hash: 0B41E1B1D10309DFDB14DFAAC984ADEBBB5FF48354F24812AE418AB250D775A841CF90

Function 06E8F5D7 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06E8F6EA

Memory Dump Source

Source File: 00000001.00000002.4110123401.0000000006E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e80000_PO_23052024.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fafde1e8bef6cd6018a8c778039bb7f0672b360cca985f25ef70d336488fd9a8
Instruction ID: 5968fbb1a8e3d672fab0d8d25cfbd4f1e3e4478404885fe3f73528b8a9564175
Opcode Fuzzy Hash: fafde1e8bef6cd6018a8c778039bb7f0672b360cca985f25ef70d336488fd9a8
Instruction Fuzzy Hash: 6441E0B1D10309DFDB14CFA9C984ADEBBB5BF48304F24822AE418AB250D7759881CF90

Function 06EE17F4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06EE2C31

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 43ef8b5c16387ddb0daf4e72f6ff0df9270f8a0b41e53133e6549e701980ca24
Instruction ID: cfe06f720945439cc6cf1ba5fc65b303f7721062a654f7cb5e74318b58ab5a86
Opcode Fuzzy Hash: 43ef8b5c16387ddb0daf4e72f6ff0df9270f8a0b41e53133e6549e701980ca24
Instruction Fuzzy Hash: 1C412BB5A00309CFDB54CF59C488A9ABBF5FB49314F14C459D519AB325D734E941CFA0

Function 06EE38BD Relevance: 1.6, APIs: 1, Instructions: 77comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06EE3950

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: ed436abffbf676d70595af7d388205d51cdc49fa9fa7ae8000921a852b315600
Instruction ID: f4f6a8b57615cda4b854af82edfc8fa6c04fdebb227cc2ee6d1bd5d3fd797620
Opcode Fuzzy Hash: ed436abffbf676d70595af7d388205d51cdc49fa9fa7ae8000921a852b315600
Instruction Fuzzy Hash: 2A31F0B4D01349EFDB10CFA9C984BCEBBF5AF48308F248019E404AB394DB756885CBA5

Function 06EE38C8 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06EE3950

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: dc25acc2bcf197f9dc6286411224644cde7d4ef04739564e512631509c77f400
Instruction ID: 237a14ed3b0cb0b5d521d3fe3e77ddc39949eb0bfa80bdb5dba2fc3208d4b90d
Opcode Fuzzy Hash: dc25acc2bcf197f9dc6286411224644cde7d4ef04739564e512631509c77f400
Instruction Fuzzy Hash: A131E0B0D01348DFDB14CF99C984BCEBBF5AF48304F248019E408AB394DB756985CBA5

Function 06EE1CD8 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06EE1D67

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4a0517822d68978566fc90056e01ccca588e385d434e3a3f910bfe2e90fbe2d0
Instruction ID: e7b868697bff3b08ade7e992b6ca78f32e4fcc57fc5b239c7f7364467433af35
Opcode Fuzzy Hash: 4a0517822d68978566fc90056e01ccca588e385d434e3a3f910bfe2e90fbe2d0
Instruction Fuzzy Hash: A82105B5D003589FDB10CFAAD984ADEBFF8EB48320F14805AE954A7351C374A990CFA1

Function 02FB7EC8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02FB7F47

Memory Dump Source

Source File: 00000001.00000002.4100120865.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2fb0000_PO_23052024.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 448a2a952b5ce911035926753b2bed1770e238c25f064fc4af595526b590bc3a
Instruction ID: efbdaa212ad97fab25fe3462c06074037f59abcc56b648da45a80dcdd3e120c3
Opcode Fuzzy Hash: 448a2a952b5ce911035926753b2bed1770e238c25f064fc4af595526b590bc3a
Instruction Fuzzy Hash: 602166B2D012598FCB10CF9AC484BEEFBF4AF49320F14846AE458A7351D338A944CFA0

Function 06EE1CE0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06EE1D67

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e33e34446644e06df945b1996eee75740fef44ee7361489f32b6d97e333c5e4e
Instruction ID: ae7321825914d7ef0a76a6a8f69b8e8ef78e07159d951c16859f9a434da0db25
Opcode Fuzzy Hash: e33e34446644e06df945b1996eee75740fef44ee7361489f32b6d97e333c5e4e
Instruction Fuzzy Hash: AE21C4B5D003589FDB10CFAAD984ADEBFF8EB48314F14841AE954A7350D374A944CFA5

Function 06EE52A8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,06EE5278,00000000,00000000), ref: 06EE532B

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 5ef93e749f82215113ad949e3f9ee0bdb010ced0a07cfd99f2c84de58511cf5f
Instruction ID: 40bf8c8d98ff0eb93fab256806e349a95623fc1576db247ae6afda2112f2183a
Opcode Fuzzy Hash: 5ef93e749f82215113ad949e3f9ee0bdb010ced0a07cfd99f2c84de58511cf5f
Instruction Fuzzy Hash: A92147B5D002098FCB54CFA9D848BEEFBF5AB88314F10842AE459A7350C775A940CFA4

Function 06EEC771 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,06EEC751,00000800), ref: 06EEC7E2

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b79d439bdef5e7b4fd1d2a90e5197f5c12305b7ee0bae67503ec53749f322baf
Instruction ID: 1a9cf4ff54b666cf0503e0490d7530a7354527b1b2939a9d23c31a24f6313805
Opcode Fuzzy Hash: b79d439bdef5e7b4fd1d2a90e5197f5c12305b7ee0bae67503ec53749f322baf
Instruction Fuzzy Hash: 901147B6D003498FCB10CFAAC844ADEFBF4AB48714F14841ED428A7200C374A544CFA0

Function 06EEB4DC Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,06EEC751,00000800), ref: 06EEC7E2

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f2a1e25e0e80c331756480999323b9d574144c3b620c9b9ca60bd22fddb8ca7b
Instruction ID: 765614406b291571c96beb190437674508018ba610f4efa3b7346f76106389fb
Opcode Fuzzy Hash: f2a1e25e0e80c331756480999323b9d574144c3b620c9b9ca60bd22fddb8ca7b
Instruction Fuzzy Hash: 2D1114B6D003498FDB20CFAAC484ADEFBF4EB48714F10842EE529A7250C375A545CFA4

Function 06E8653C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,06E8BE92), ref: 06E8BF7F

Memory Dump Source

Source File: 00000001.00000002.4110123401.0000000006E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e80000_PO_23052024.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 06607083f13c7a1e95d36bb36e51fc1b12d92ad077b78518b8c378a346814d95
Instruction ID: 90637a9d3fa44fdaeec6868134fa2a4cb45f448c2f2b990d69bb1869d3100a06
Opcode Fuzzy Hash: 06607083f13c7a1e95d36bb36e51fc1b12d92ad077b78518b8c378a346814d95
Instruction Fuzzy Hash: 391122B1C002599FCB10DF9AC944B9EFBF4EB08324F14852AE818A7241D378A940CFE5

Function 06E8BF10 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,06E8BE92), ref: 06E8BF7F

Memory Dump Source

Source File: 00000001.00000002.4110123401.0000000006E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e80000_PO_23052024.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: f55675f793db02e8bfc33082baeda73065af2db3293ee314e9a6eb43730c9bd9
Instruction ID: 7a2e6afb93b0709d0e3c0e107f80ebeb50736d824be90e8682f0044fa21f7e4c
Opcode Fuzzy Hash: f55675f793db02e8bfc33082baeda73065af2db3293ee314e9a6eb43730c9bd9
Instruction Fuzzy Hash: 8D1117B5C002599FCB10DF9AC5447DEFBB4EF48324F14816AE418B7641D378A945CFA5

Function 06E8D540 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06E8E596

Memory Dump Source

Source File: 00000001.00000002.4110123401.0000000006E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e80000_PO_23052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3fb70a913afa096831a4e544e738c5826ab8a95020826a983a80c419f1ccf1f9
Instruction ID: d30ad7828873dbd5996a24a71e42e0d01f3d2c2c3d7c6637c88935a5332ff442
Opcode Fuzzy Hash: 3fb70a913afa096831a4e544e738c5826ab8a95020826a983a80c419f1ccf1f9
Instruction Fuzzy Hash: 6C1120B5C003488FDB20DF9AC444ADEFBF4AB49314F10842AD458B7210D374A545CFA0

Function 06EE3320 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06EE37D5

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 32e8288095596a383dac924c9fff0d2d98f53bfc6b1329f48804e42ebd4b360c
Instruction ID: fbd584a15673d0d6a1e9fdb418ab2d8ccf9cde56a7f63a947259809e7dfcc9de
Opcode Fuzzy Hash: 32e8288095596a383dac924c9fff0d2d98f53bfc6b1329f48804e42ebd4b360c
Instruction Fuzzy Hash: A4112EB5900348CFCB20DF9AC588B9EBBF4EB48324F20845AE558A7650C379A940CFA4

Function 06EE184C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06EE2E85), ref: 06EE2F0F

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1dec7c2fd5ec33655ae265030a363a61f75fa0246ccd548572181065b4ad117b
Instruction ID: afc0b9aa3a862aa5cc1928fa203858eb29bdfba8f8759f0f3acaa5b13d651265
Opcode Fuzzy Hash: 1dec7c2fd5ec33655ae265030a363a61f75fa0246ccd548572181065b4ad117b
Instruction Fuzzy Hash: 4F1106B5800348CFCB60DF99C489BDEBBF8EB49324F208459D559A7350D375A944CFA5

Function 06EE3779 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06EE37D5

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a3f1eb210e86194978d3304e96a8c254b9b9de0e0b578d3ecfc3b3f1bc1f660c
Instruction ID: 1bc2801f7bdfed6b36e93799d948496459ad708d98c1915d0f4a7b27f972cac1
Opcode Fuzzy Hash: a3f1eb210e86194978d3304e96a8c254b9b9de0e0b578d3ecfc3b3f1bc1f660c
Instruction Fuzzy Hash: BB1103B5900348CFDB20CFAAD588BDEBFF4AB48328F14845AE558A7750C339A544CFA4

Function 06E8E52F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06E8E596

Memory Dump Source

Source File: 00000001.00000002.4110123401.0000000006E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e80000_PO_23052024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0057e5bec679266ad1db40c5f1a9bd1380c00d46d23731724dcc2e9b30f1b016
Instruction ID: 1320577a955b44a60f946f2746cf579bb882d00946570446b5bb26d064dcde78
Opcode Fuzzy Hash: 0057e5bec679266ad1db40c5f1a9bd1380c00d46d23731724dcc2e9b30f1b016
Instruction Fuzzy Hash: 1111DCB6C003498EDB20DF9AD948ADEFBF4AB48324F14842AD469B7610D379A545CFA1

Function 06EE2EA8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06EE2E85), ref: 06EE2F0F

Memory Dump Source

Source File: 00000001.00000002.4110178544.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ee0000_PO_23052024.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 266792cecd892edfc4e61b4f16bb7bff8ece9ab8548ab7d9497e8233428e9b84
Instruction ID: 0ce9ec90bf2d35294a73b4b375077979f55bd00f5b3ec23d80561132f07d015a
Opcode Fuzzy Hash: 266792cecd892edfc4e61b4f16bb7bff8ece9ab8548ab7d9497e8233428e9b84
Instruction Fuzzy Hash: 5E11FEB5800248CFCB20CF99C988BDEBBF4AB48324F24845AD559A7250D378A944CFA4

Function 02E2D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4099890905.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e2d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1900f6bbbd2d9ae73031a01a0b31e6f75beec10f225a313c86198aa3ac430311
Instruction ID: 89e2893aef042d2d66ea05e6b60c07d5cd1d0ff8461b75a28133d5ded6b3470b
Opcode Fuzzy Hash: 1900f6bbbd2d9ae73031a01a0b31e6f75beec10f225a313c86198aa3ac430311
Instruction Fuzzy Hash: 97212971544204DFDB14DF14CDC4F26BB66FB88318F24C56DEA4A4B361C736D84ACA61

Function 02E2D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4099890905.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e2d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c70146c91fdf5b43c214505ea2519cea7e4b3c6a9e79975dd79800d991ddc91
Instruction ID: a24633b8f8b0237f42e5959d532857ab07d657196f10087e602f7a7f86029ee6
Opcode Fuzzy Hash: 2c70146c91fdf5b43c214505ea2519cea7e4b3c6a9e79975dd79800d991ddc91
Instruction Fuzzy Hash: 1F215772584244DFDB01DF14DDC4B6AFBA5FB84328F20C669EA4F4B245C37AD84ACA61

Function 02E2D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4099890905.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e2d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f34096b38c3b648888631b0b968dc131b53bf251c02dbd972bbf5d1f8061303
Instruction ID: 2030916d85114c602c07ca67f04656f967ae890fafbf16e48b6baed3abc72a14
Opcode Fuzzy Hash: 9f34096b38c3b648888631b0b968dc131b53bf251c02dbd972bbf5d1f8061303
Instruction Fuzzy Hash: 8A212671584204DFDB08DF14DDC4B26BBA5FB84318F20C56DDA0B4B296C376E84ACA61

Function 02E2D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4099890905.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e2d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: a324789c9882cc5e64816d2f6a8ef0e5dac72cc67cdac4f2e5fa2968f700e715
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: F311B276544284CFDB12CF14D9C4B56FFA1FB84328F24C6AADD4A4B656C33AD40ACB51

Function 02E2D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4099890905.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e2d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 0dde9dc2b43e4992da45731776a0325337166aff00250ca50d52df50ed8ad3cc
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E211DD75544280CFDB09CF10D9C4B15BFB2FB84318F24C6AAD94A4B256C33AE40ACBA1

Function 02E2D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4099890905.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2e2d000_PO_23052024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: b60ea346c9f0cc8033fc314f6dde76fa91df2924bed2c1c603244cd4b738ba98
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BE11D075544244CFCB15CF10C9C4B16BF62FB44318F28C6A9D94A4B662C33AD84ACF61

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO_23052024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_23052024.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
PO_23052024.exe

Function 0172D449 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 0172D458 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0172ADC8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 0172590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 0172449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0172D698 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 0172D6A0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 0172A188 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0172B238 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0172AFB8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 06EE1A78 Relevance: 6.1, APIs: 4, Instructions: 143
threadCOMMON

Function 06EE1A98 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06EE1A97 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Function 06E8BE40 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre