Edit tour

Windows Analysis Report
DHL Delivery Invoice.exe

Overview

General Information

Sample name:	DHL Delivery Invoice.exe
Analysis ID:	1564050
MD5:	9af85d4623cafa79192f542727a6e923
SHA1:	3739dbeeec123626e43210a4daf52d07b2a4247e
SHA256:	320bf0a79235fdbfd5d1adadcfc530e134d9cf3aa67bfb5c63dfddbc3bb3963f
Tags:	DHLexeuser-abuse_ch
Infos:

Detection

AgentTesla, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL Delivery Invoice.exe (PID: 6724 cmdline: "C:\Users\user\Desktop\DHL Delivery Invoice.exe" MD5: 9AF85D4623CAFA79192F542727A6E923)

powershell.exe (PID: 5820 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2840 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LIWBHGsz.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7260 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3720 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DHL Delivery Invoice.exe (PID: 6432 cmdline: "C:\Users\user\Desktop\DHL Delivery Invoice.exe" MD5: 9AF85D4623CAFA79192F542727A6E923)

DHL Delivery Invoice.exe (PID: 2032 cmdline: "C:\Users\user\Desktop\DHL Delivery Invoice.exe" MD5: 9AF85D4623CAFA79192F542727A6E923)

LIWBHGsz.exe (PID: 2852 cmdline: C:\Users\user\AppData\Roaming\LIWBHGsz.exe MD5: 9AF85D4623CAFA79192F542727A6E923)

schtasks.exe (PID: 7392 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LIWBHGsz.exe (PID: 7436 cmdline: "C:\Users\user\AppData\Roaming\LIWBHGsz.exe" MD5: 9AF85D4623CAFA79192F542727A6E923)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "wizzy@transmedmaritime.cf", "Password": "!feanyi#@12"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1843513866.00000000079A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.4254539671.0000000000437000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1828601395.0000000004318000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: DHL Delivery Invoice.exe PID: 6724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Delivery Invoice.exe PID: 6724	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL Delivery Invoice.exe PID: 6724	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL Delivery Invoice.exe PID: 2032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Delivery Invoice.exe PID: 2032	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LIWBHGsz.exe PID: 2852	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LIWBHGsz.exe PID: 2852	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: LIWBHGsz.exe PID: 2852	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LIWBHGsz.exe PID: 7436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LIWBHGsz.exe PID: 7436	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DHL Delivery Invoice.exe.4335828.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.79a0000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.4355848.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.79a0000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.4335828.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.LIWBHGsz.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.LIWBHGsz.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.LIWBHGsz.exe.4909990.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LIWBHGsz.exe.4909990.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.LIWBHGsz.exe.4909990.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.LIWBHGsz.exe.4909990.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LIWBHGsz.exe.4909990.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.LIWBHGsz.exe.4b6ace8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LIWBHGsz.exe.4b6ace8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.LIWBHGsz.exe.4909990.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.LIWBHGsz.exe.4b6ace8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dc4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dcc1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dd4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dddd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6de47:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6deb9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6df4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6dfdf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb224f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xecc6f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x12748f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb22c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xecce1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x127501:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb234b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xecd6b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x12758b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb23dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xecdfd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12761d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb2447:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xece67:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x127687:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb24b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xeced9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1276f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb254f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xecf6f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x12778f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x13106f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16ba8f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a62af:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1310e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16bb01:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a6321:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x13116b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16bb8b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a63ab:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1311fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16bc1d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a643d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x131267:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16bc87:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a64a7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1312d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16bcf9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a6519:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x13136f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16bd8f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a65af:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35650f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x390f2f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3cb74f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x356581:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x390fa1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3cb7c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35660b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x39102b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3cb84b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35669d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3910bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3cb8dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x356707:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x391127:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3cb947:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x356779:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x391199:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3cb9b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35680f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x39122f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3cba4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x10e89:$s1: file:/// 0x10de5:$s2: {11111-22222-10009-11112} 0x10e19:$s3: {11111-22222-50001-00000} 0xf1b3:$s4: get_Module 0x353347:$s5: Reverse 0x38dd67:$s5: Reverse 0x3c8587:$s5: Reverse 0x2567d0:$s6: BlockCopy 0x2d55f0:$s6: BlockCopy 0x355cce:$s6: BlockCopy 0x3906ee:$s6: BlockCopy 0x3caf0e:$s6: BlockCopy 0x25664d:$s7: ReadByte 0x2d546d:$s7: ReadByte 0x3535ac:$s7: ReadByte 0x38dfcc:$s7: ReadByte 0x3c87ec:$s7: ReadByte 0x10e9b:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 29 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DHL Delivery Invoice.exe", ParentImage: C:\Users\user\Desktop\DHL Delivery Invoice.exe, ParentProcessId: 6724, ParentProcessName: DHL Delivery Invoice.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe", ProcessId: 5820, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\LIWBHGsz.exe, ParentImage: C:\Users\user\AppData\Roaming\LIWBHGsz.exe, ParentProcessId: 2852, ParentProcessName: LIWBHGsz.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp", ProcessId: 7392, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.88.21.158, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\DHL Delivery Invoice.exe, Initiated: true, ProcessId: 2032, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49735

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\DHL Delivery Invoice.exe", ParentImage: C:\Users\user\Desktop\DHL Delivery Invoice.exe, ParentProcessId: 6724, ParentProcessName: DHL Delivery Invoice.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp", ProcessId: 3720, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DHL Delivery Invoice.exe", ParentImage: C:\Users\user\Desktop\DHL Delivery Invoice.exe, ParentProcessId: 6724, ParentProcessName: DHL Delivery Invoice.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe", ProcessId: 5820, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\DHL Delivery Invoice.exe", ParentImage: C:\Users\user\Desktop\DHL Delivery Invoice.exe, ParentProcessId: 6724, ParentProcessName: DHL Delivery Invoice.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp", ProcessId: 3720, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 10.2.LIWBHGsz.exe.4909990.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "wizzy@transmedmaritime.cf", "Password": "!feanyi#@12"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: DHL Delivery Invoice.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: DHL Delivery Invoice.exe

Joe Sandbox ML: detected

Source: DHL Delivery Invoice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: DHL Delivery Invoice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 77.88.21.158:587

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 77.88.21.158 77.88.21.158

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 77.88.21.158:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.yandex.com

Source: DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4289247854.0000000009561000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4277773414.0000000006AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl
Source: LIWBHGsz.exe, 0000000E.00000002.4277374146.0000000006A87000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl(
Source: DHL Delivery Invoice.exe, 00000009.00000002.4276985451.0000000006311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl0
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4278167799.000000000633A000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4281289694.0000000009274000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.0000000006302000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000028DD000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4255566065.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288279299.00000000094D0000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278242421.0000000006AE2000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0j
Source: LIWBHGsz.exe, 0000000E.00000002.4277513647.0000000006A97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/roo-
Source: LIWBHGsz.exe, 0000000E.00000002.4277513647.0000000006A97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/roo--
Source: LIWBHGsz.exe, 0000000E.00000002.4278117301.0000000006AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/rooN
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4278167799.000000000633A000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.00000000062E3000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288788386.000000000951C000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278242421.0000000006AE2000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.000000000134B000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003285000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278117301.0000000006AD4000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.0000000001330000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000035AF000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4289247854.0000000009561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4280859164.000000000924C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.00000000062E3000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4289443671.000000000957D000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288279299.00000000094D0000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288331730.00000000094D5000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.000000000134B000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003285000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288977120.0000000009559000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.comD
Source: LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gls
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4278167799.000000000633A000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4281289694.0000000009274000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.0000000006302000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000028DD000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4255566065.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288279299.00000000094D0000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278242421.0000000006AE2000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4280859164.000000000924C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.00000000062E3000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4289443671.000000000957D000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288279299.00000000094D0000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288331730.00000000094D5000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.000000000134B000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003285000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278117301.0000000006AD4000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288977120.0000000009559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globa
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4278167799.000000000633A000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.00000000062E3000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288788386.000000000951C000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4277374146.0000000006A87000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278242421.0000000006AE2000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.000000000134B000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003285000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278117301.0000000006AD4000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsh
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4278167799.000000000633A000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4281289694.0000000009274000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.0000000006302000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000028DD000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4255566065.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288279299.00000000094D0000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4278242421.0000000006AE2000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002CC3000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.000000000290C000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003223000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000035AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/_prof_basesDataSet.xsd
Source: LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/_prof_basesDataSet1.xsd
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/
Source: LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/activity/
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/album/
Source: LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/channel/
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/group/
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/video/
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4254539671.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4254547194.0000000000433000.00000040.00000400.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repositor
Source: DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002914000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4280859164.000000000924C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4278167799.000000000633A000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4281289694.0000000009274000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.0000000006302000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4276985451.00000000062E3000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4282180177.000000000930E000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000028DD000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4255566065.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4289443671.000000000957D000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\DHL Delivery Invoice.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\LIWBHGsz.exe

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.LIWBHGsz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.LIWBHGsz.exe.4909990.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.LIWBHGsz.exe.4909990.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.LIWBHGsz.exe.4b6ace8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL Delivery Invoice.exe

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA2690	0_2_02AA2690
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA97E0	0_2_02AA97E0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA1408	0_2_02AA1408
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA3540	0_2_02AA3540
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA1C98	0_2_02AA1C98
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA2148	0_2_02AA2148
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AACA98	0_2_02AACA98
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA0870	0_2_02AA0870
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA4FE0	0_2_02AA4FE0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA4FF0	0_2_02AA4FF0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA132F	0_2_02AA132F
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA1363	0_2_02AA1363
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA56E8	0_2_02AA56E8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA56F8	0_2_02AA56F8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA3450	0_2_02AA3450
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA5AE8	0_2_02AA5AE8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA5AF8	0_2_02AA5AF8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA58A0	0_2_02AA58A0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_02AA58B0	0_2_02AA58B0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097157DC	0_2_097157DC
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097157D5	0_2_097157D5
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_09717628	0_2_09717628
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097E2E58	0_2_097E2E58
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097E92E8	0_2_097E92E8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097ED8E0	0_2_097ED8E0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097E2B70	0_2_097E2B70
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097E2B60	0_2_097E2B60
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097EDD38	0_2_097EDD38
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097E2E4C	0_2_097E2E4C
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_097EE170	0_2_097EE170
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_09835AB0	0_2_09835AB0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_09833ADC	0_2_09833ADC
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_09830040	0_2_09830040
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 0_2_09830550	0_2_09830550
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E841C8	9_2_00E841C8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E8E299	9_2_00E8E299
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E8A968	9_2_00E8A968
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E84A98	9_2_00E84A98
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E8DCC0	9_2_00E8DCC0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E83E80	9_2_00E83E80
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06536648	9_2_06536648
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06535628	9_2_06535628
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_0653B282	9_2_0653B282
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_065330E0	9_2_065330E0
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06537DD8	9_2_06537DD8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_0653C1E8	9_2_0653C1E8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_065376F8	9_2_065376F8
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06530040	9_2_06530040
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_0653E400	9_2_0653E400
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06532408	9_2_06532408
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06535D3B	9_2_06535D3B
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_066218CA	9_2_066218CA
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06621902	9_2_06621902
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06621908	9_2_06621908
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06530006	9_2_06530006
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_02E62CA0	10_2_02E62CA0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_02E64CB8	10_2_02E64CB8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_02E60040	10_2_02E60040
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_02E60006	10_2_02E60006
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_02E62C94	10_2_02E62C94
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_02E64C98	10_2_02E64C98
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_02E60550	10_2_02E60550
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03042690	10_2_03042690
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_030497E0	10_2_030497E0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03043540	10_2_03043540
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03041408	10_2_03041408
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03041C98	10_2_03041C98
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03042148	10_2_03042148
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03040870	10_2_03040870
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03044FE0	10_2_03044FE0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03044FF0	10_2_03044FF0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_030413DE	10_2_030413DE
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_030456E8	10_2_030456E8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_030456F8	10_2_030456F8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_0304350D	10_2_0304350D
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_0304345F	10_2_0304345F
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03045AE8	10_2_03045AE8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_03045AF8	10_2_03045AF8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_030458A0	10_2_030458A0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_030458B0	10_2_030458B0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_07F657DC	10_2_07F657DC
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_07F657D6	10_2_07F657D6
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_07F67628	10_2_07F67628
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A2E58	10_2_086A2E58
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A9320	10_2_086A9320
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A2AE6	10_2_086A2AE6
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A2B60	10_2_086A2B60
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A2B70	10_2_086A2B70
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A2DF8	10_2_086A2DF8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A2E4C	10_2_086A2E4C
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A2E57	10_2_086A2E57
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086ADF08	10_2_086ADF08
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086AE340	10_2_086AE340
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086AA4E0	10_2_086AA4E0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_030941C8	14_2_030941C8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_03094A98	14_2_03094A98
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_03093E80	14_2_03093E80
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_0309AD4A	14_2_0309AD4A
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE6648	14_2_06CE6648
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE5628	14_2_06CE5628
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE7DD8	14_2_06CE7DD8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CEB283	14_2_06CEB283
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE30E0	14_2_06CE30E0
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CEC1E8	14_2_06CEC1E8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE76F8	14_2_06CE76F8
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE2408	14_2_06CE2408
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CEE400	14_2_06CEE400
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE5D3B	14_2_06CE5D3B
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE0040	14_2_06CE0040
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_06CE0006	14_2_06CE0006

Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedf8fc031-c024-49b7-9cf2-cdfecdf01d4a.exe4 vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1824455417.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1843513866.00000000079A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedf8fc031-c024-49b7-9cf2-cdfecdf01d4a.exe4 vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1850359008.0000000009D70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1824455417.0000000000DB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000000.1788290888.0000000000796000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSLRd.exe, vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe, 00000009.00000002.4255194280.00000000008F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL Delivery Invoice.exe
Source: DHL Delivery Invoice.exe	Binary or memory string: OriginalFilenameSLRd.exe, vs DHL Delivery Invoice.exe

Source: DHL Delivery Invoice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 14.2.LIWBHGsz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.LIWBHGsz.exe.4909990.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.LIWBHGsz.exe.4909990.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.LIWBHGsz.exe.4b6ace8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: DHL Delivery Invoice.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: LIWBHGsz.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, id.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Delivery Invoice.exe.4335828.4.raw.unpack, id.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Delivery Invoice.exe.79a0000.5.raw.unpack, id.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: _0020.AddAccessRule
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, nW3n9DtCUKVoFXJXYL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, nW3n9DtCUKVoFXJXYL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: _0020.AddAccessRule
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, nW3n9DtCUKVoFXJXYL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, T4MYihU2jTbHZyP9hj.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@2/2

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

File created: C:\Users\user\AppData\Roaming\LIWBHGsz.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1508:120:WilError_03

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC314.tmp

Jump to behavior

Source: DHL Delivery Invoice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL Delivery Invoice.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE [dbo].[adUsers] SET [samAccountName] = @samAccountName, [_dn] = @_dn, [phoneCorp] = @phoneCorp, [phoneMobile] = @phoneMobile, [IpPhone] = @IpPhone, [key_card] = @key_card WHERE (([id] = @Original_id) AND ([samAccountName] = @Original_samAccountName) AND ([_dn] = @Original__dn) AND ((@IsNull_phoneCorp = 1 AND [phoneCorp] IS NULL) OR ([phoneCorp] = @Original_phoneCorp)) AND ((@IsNull_phoneMobile = 1 AND [phoneMobile] IS NULL) OR ([phoneMobile] = @Original_phoneMobile)) AND ((@IsNull_IpPhone = 1 AND [IpPhone] IS NULL) OR ([IpPhone] = @Original_IpPhone)) AND ((@IsNull_key_card = 1 AND [key_card] IS NULL) OR ([key_card] = @Original_key_card)));
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO [dbo].[adUsers] ([samAccountName], [_dn], [phoneCorp], [phoneMobile], [IpPhone], [key_card]) VALUES (@samAccountName, @_dn, @phoneCorp, @phoneMobile, @IpPhone, @key_card);
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE [dbo].[Employee_photo] SET [Id] = @Id, [SerialNumber] = @SerialNumber, [ePhoto] = @ePhoto, [ePath] = @ePath, [id_empl] = @id_empl WHERE (([id_photo] = @Original_id_photo) AND ([Id] = @Original_Id) AND ((@IsNull_SerialNumber = 1 AND [SerialNumber] IS NULL) OR ([SerialNumber] = @Original_SerialNumber)) AND ((@IsNull_ePath = 1 AND [ePath] IS NULL) OR ([ePath] = @Original_ePath)) AND ([id_empl] = @Original_id_empl));
Source: DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO [dbo].[Employee_photo] ([Id], [SerialNumber], [ePhoto], [ePath], [id_empl]) VALUES (@Id, @SerialNumber, @ePhoto, @ePath, @id_empl);

Source: DHL Delivery Invoice.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

File read: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DHL Delivery Invoice.exe "C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Users\user\Desktop\DHL Delivery Invoice.exe "C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Users\user\Desktop\DHL Delivery Invoice.exe "C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\LIWBHGsz.exe C:\Users\user\AppData\Roaming\LIWBHGsz.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process created: C:\Users\user\AppData\Roaming\LIWBHGsz.exe "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Users\user\Desktop\DHL Delivery Invoice.exe "C:\Users\user\Desktop\DHL Delivery Invoice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Users\user\Desktop\DHL Delivery Invoice.exe "C:\Users\user\Desktop\DHL Delivery Invoice.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp"
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process created: C:\Users\user\AppData\Roaming\LIWBHGsz.exe "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DHL Delivery Invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL Delivery Invoice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.DHL Delivery Invoice.exe.4335828.4.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.DHL Delivery Invoice.exe.79a0000.5.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, T4MYihU2jTbHZyP9hj.cs	.Net Code: HdPubs9aVL System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, T4MYihU2jTbHZyP9hj.cs	.Net Code: HdPubs9aVL System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, T4MYihU2jTbHZyP9hj.cs	.Net Code: HdPubs9aVL System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E8E762 push ds; ret	9_2_00E8E763
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E80C6D push edi; retf	9_2_00E80C7A
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_00E8AEDE push edx; ret	9_2_00E8AEE5
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06627670 push esp; iretd	9_2_06627679
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Code function: 9_2_06627C24 push esp; iretd	9_2_06627C2D
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_07F61F40 pushad ; iretd	10_2_07F61F4D
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A3FC8 pushfd ; iretd	10_2_086A3FD6
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 10_2_086A40FC pushfd ; iretd	10_2_086A40FE
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Code function: 14_2_03090C6D push edi; retf	14_2_03090C7A

Source: DHL Delivery Invoice.exe	Static PE information: section name: .text entropy: 7.469334701221808
Source: LIWBHGsz.exe.0.dr	Static PE information: section name: .text entropy: 7.469334701221808

Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, s3M8YEIWMsI4GaRjOl.cs	High entropy of concatenated method names: 'bugyGBoTgU', 'WGqynxvpqV', 'Y65yykZFHl', 'Bw1yrK8Sda', 'wQdyS3WG8L', 'yUfyHmPour', 'Dispose', 'xm97W2QMaX', 'MQI70HKbc0', 'ftQ73CAtHG'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, hRi78eY2vqba3sjOFgE.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'I9ECeMD3Be', 'V7uCmdZEVp', 'DUACJqGCPo', 'zGBCaJLRaI', 'e2UCweY0vY', 'B5mCRL99YO', 'basCiefJ48'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, eV2UW4jMaGcT6OE5sg.cs	High entropy of concatenated method names: 'SGunLTe1Ci', 'j7qnOu7cyQ', 'SIw72kttqG', 'aMw7YWFGKM', 'OPxneH03Rd', 'tRfnmu29hG', 'oG3nJ43Uu3', 'ffvnay4Otc', 'U01nwdlkB7', 'vlcnReSL8C'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, AhqLRAzDifvQitaSMY.cs	High entropy of concatenated method names: 'DCFCDWkHne', 'aXuCtm2uA0', 'syxCAUKMAw', 'nkHCl5SYBX', 'J5QCQIT6kv', 'kniCVfuZ7R', 'BgkCvf2jmp', 'C8NCH66Sd0', 'mpWC5t7OQe', 'uKEC4rx5Q4'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, KY302Gupdo3G84DdV4.cs	High entropy of concatenated method names: 'bXdY8W3n9D', 'sUKYUVoFXJ', 'ssLY6YVfId', 'jX6YddeoOi', 'bk2YGaJABo', 'YdSY9DPIU1', 'NILI6LxygqnmD3FF7L', 'Ywwe2RJBb2JYGBoSb6', 'eTBYYye0Wr', 'O7eYhisBv7'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, nW3n9DtCUKVoFXJXYL.cs	High entropy of concatenated method names: 'ItS0a5Vmaf', 'NM30wMKDOW', 'A3D0RdZ0pm', 'uxH0iEAGsA', 'UOZ014kgnD', 'rci0j7Cmp3', 'IPa0IoI4jD', 'jFl0LRRsru', 'sR90qOhksn', 'Pj80OInC4h'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, r10FOIq3RwJJSDBE6T.cs	High entropy of concatenated method names: 'HDpyloxufv', 'UXbyQr7Exk', 'uV9yKNI40X', 'ONcyVAUINA', 'DLoyv6KpFC', 'F6Gyk4HyUT', 'C7OycQvjwd', 'nNKyT9JaaA', 'JY0yfaoaSS', 'qQOyF5ZlyA'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, ak9TLTYYo3XPXTuLLCn.cs	High entropy of concatenated method names: 'xNYCOKTpuf', 'zvTCz9VAKk', 'TQMr2AXJ8U', 'CV9rYJ2GvD', 'afqrNn5Qxd', 'tI8rhCSCmE', 'pl5ruDHxHN', 'uB7roHWyaD', 'Jo6rWOwvyI', 'GNBr0HYXa1'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, zYIKPrYuoh0gmw1dmks.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tRLgyXWa0d', 'lGfgCRuOBk', 'lxwgrgl0Cw', 'XJvggt3EmU', 'sH8gSFkv16', 'kxVgs4W9Be', 'hcjgHVdmaL'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, aQHQCCAsLYVfId8X6d.cs	High entropy of concatenated method names: 'svN3pGU1xV', 'GZH3Dwkw0K', 'Yi73tbOLXZ', 'MMe3AyhHyN', 'a383GIXmrL', 'afr39fbhNy', 'jJb3nU6p31', 'wrs37kjo6t', 'd7H3yCIgCQ', 'k943CsXx3f'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, raUZwtankETy9DHvxq.cs	High entropy of concatenated method names: 'XhrGFsC4wL', 'vBAGmH8YWu', 'Qw6Ga2sDav', 'FA6GwG9cYM', 'GpXGQ1PsPR', 'BMRGKj6HGB', 'qypGVSmjYs', 'U58GvNaKnO', 'P2pGkpsslL', 'NvrGcR2npg'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, blCDnlN5aw2LgftDY2.cs	High entropy of concatenated method names: 'sjJbBFGs7', 'rj4pypSxr', 'rZeDQ77cn', 'rAMB9sUrE', 'A30ARZ4u7', 'UYEXSrS17', 'uXkQ7dI4E8cViZ1ScI', 'ihfvoSTDHhvJljB0Kq', 'J9n7EOqgG', 'd7YC6W9DO'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, OoOiy3XUylJnXYk2aJ.cs	High entropy of concatenated method names: 'JrpxEY5y53', 'WThxBSXAvl', 'PyG3KdQNVv', 'XEg3VvcDXO', 'Ytc3vGQcCN', 'BmD3kkobU2', 'jdk3c2xSEf', 'u3F3T0CwYf', 'Ltw3flFFZk', 'Duc3Fl4i46'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, T4MYihU2jTbHZyP9hj.cs	High entropy of concatenated method names: 'AAjhoMgorH', 'bI0hWpRlfO', 'ST2h0PYG1L', 'MNih32ZIyu', 'oVwhxlxglw', 'sI4hZkDFpv', 'QfKh8RD9Tu', 'U4XhU2OIHX', 'a0rhPJJaTk', 'RmJh6eVvq4'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, Dd2Bi7JvwPWUxrQeTw.cs	High entropy of concatenated method names: 'm6SMtHkp2K', 'AejMA47DFm', 'ubxMl6icFV', 'ywiMQWmdeN', 'pJRMVg7xjp', 'hRWMvvM1Pr', 'D9XMc9G80J', 'HHCMTpQAHR', 'fYoMFmhp5e', 'coJMeBhc3Q'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, bKGaGCfN9r8b3dAxfR.cs	High entropy of concatenated method names: 'BWh85jVV9w', 'l4t8402TsD', 'U3i8b96aHo', 'eyS8pGBfjH', 'qyM8EUjIQZ', 'GLT8DjxZdi', 'sMH8BOZdEm', 'NkJ8t0HKt1', 'je68AZNDDD', 'iH48XqcaoE'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, psJmfbcnh2UHCfO6X1.cs	High entropy of concatenated method names: 'doi8WEr9EH', 'WiC83D7CGt', 'xLP8Z4u0V8', 'dQZZOU2Bxt', 'THjZzlHolR', 'Hak821U2DW', 'lP28Yeyepr', 'NNy8NwM91q', 'G4r8haSOiV', 'dxr8uWgWUo'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, nlClL9RBjENyMP58Sf.cs	High entropy of concatenated method names: 'ToString', 'euG9e2dejU', 'Utj9QoUb4N', 'LXg9KAVG8L', 'O3D9Va80Ak', 'OtM9vFJWRr', 'Sbq9kP6okc', 'gkX9c4qXrP', 'MP29TAq7Cp', 'SuS9fIIIVn'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, YfCfd4O8KR8Cn3tWPs.cs	High entropy of concatenated method names: 'x34C31kRmi', 'KfeCxU9JBD', 'yObCZKn68F', 'fKsC8DdcLP', 'eWXCyk7Ysm', 'AsdCUju54q', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, MKu06VYhTUgWX8T7pex.cs	High entropy of concatenated method names: 'IgHrOG1xwL', 'TJZrz8Uc9u', 'Xftg2BptFh', 'AxRuDZHPEhewdED7evS', 'nLXmqPHdwlEaly45t7y', 'u159PWHH02DLxmNGMEn', 'vdW1SgHK0WCWLquc8iu'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, EBoOdSlDPIU1RApnZW.cs	High entropy of concatenated method names: 'mtkZovqfLX', 'wCEZ00W1Y8', 'b4dZxQIqrY', 'OBIZ85XOT0', 't8pZUMqrA3', 'EsMx1Tm4XQ', 'MSAxjBM9Ha', 'E1sxIgGVdR', 'MEVxLaQr0Q', 'CvRxq6FcG2'
Source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, W3NEvE0F9vk3mc0EGh.cs	High entropy of concatenated method names: 'Dispose', 'wI4YqGaRjO', 'DN4NQALee0', 'DwOCGjEhbn', 'FaXYOlPf4U', 'NT8YzIB8jv', 'ProcessDialogKey', 'GU7N210FOI', 'hRwNYJJSDB', 'B6TNNOfCfd'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, s3M8YEIWMsI4GaRjOl.cs	High entropy of concatenated method names: 'bugyGBoTgU', 'WGqynxvpqV', 'Y65yykZFHl', 'Bw1yrK8Sda', 'wQdyS3WG8L', 'yUfyHmPour', 'Dispose', 'xm97W2QMaX', 'MQI70HKbc0', 'ftQ73CAtHG'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, hRi78eY2vqba3sjOFgE.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'I9ECeMD3Be', 'V7uCmdZEVp', 'DUACJqGCPo', 'zGBCaJLRaI', 'e2UCweY0vY', 'B5mCRL99YO', 'basCiefJ48'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, eV2UW4jMaGcT6OE5sg.cs	High entropy of concatenated method names: 'SGunLTe1Ci', 'j7qnOu7cyQ', 'SIw72kttqG', 'aMw7YWFGKM', 'OPxneH03Rd', 'tRfnmu29hG', 'oG3nJ43Uu3', 'ffvnay4Otc', 'U01nwdlkB7', 'vlcnReSL8C'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, AhqLRAzDifvQitaSMY.cs	High entropy of concatenated method names: 'DCFCDWkHne', 'aXuCtm2uA0', 'syxCAUKMAw', 'nkHCl5SYBX', 'J5QCQIT6kv', 'kniCVfuZ7R', 'BgkCvf2jmp', 'C8NCH66Sd0', 'mpWC5t7OQe', 'uKEC4rx5Q4'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, KY302Gupdo3G84DdV4.cs	High entropy of concatenated method names: 'bXdY8W3n9D', 'sUKYUVoFXJ', 'ssLY6YVfId', 'jX6YddeoOi', 'bk2YGaJABo', 'YdSY9DPIU1', 'NILI6LxygqnmD3FF7L', 'Ywwe2RJBb2JYGBoSb6', 'eTBYYye0Wr', 'O7eYhisBv7'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, nW3n9DtCUKVoFXJXYL.cs	High entropy of concatenated method names: 'ItS0a5Vmaf', 'NM30wMKDOW', 'A3D0RdZ0pm', 'uxH0iEAGsA', 'UOZ014kgnD', 'rci0j7Cmp3', 'IPa0IoI4jD', 'jFl0LRRsru', 'sR90qOhksn', 'Pj80OInC4h'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, r10FOIq3RwJJSDBE6T.cs	High entropy of concatenated method names: 'HDpyloxufv', 'UXbyQr7Exk', 'uV9yKNI40X', 'ONcyVAUINA', 'DLoyv6KpFC', 'F6Gyk4HyUT', 'C7OycQvjwd', 'nNKyT9JaaA', 'JY0yfaoaSS', 'qQOyF5ZlyA'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, ak9TLTYYo3XPXTuLLCn.cs	High entropy of concatenated method names: 'xNYCOKTpuf', 'zvTCz9VAKk', 'TQMr2AXJ8U', 'CV9rYJ2GvD', 'afqrNn5Qxd', 'tI8rhCSCmE', 'pl5ruDHxHN', 'uB7roHWyaD', 'Jo6rWOwvyI', 'GNBr0HYXa1'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, zYIKPrYuoh0gmw1dmks.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tRLgyXWa0d', 'lGfgCRuOBk', 'lxwgrgl0Cw', 'XJvggt3EmU', 'sH8gSFkv16', 'kxVgs4W9Be', 'hcjgHVdmaL'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, aQHQCCAsLYVfId8X6d.cs	High entropy of concatenated method names: 'svN3pGU1xV', 'GZH3Dwkw0K', 'Yi73tbOLXZ', 'MMe3AyhHyN', 'a383GIXmrL', 'afr39fbhNy', 'jJb3nU6p31', 'wrs37kjo6t', 'd7H3yCIgCQ', 'k943CsXx3f'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, raUZwtankETy9DHvxq.cs	High entropy of concatenated method names: 'XhrGFsC4wL', 'vBAGmH8YWu', 'Qw6Ga2sDav', 'FA6GwG9cYM', 'GpXGQ1PsPR', 'BMRGKj6HGB', 'qypGVSmjYs', 'U58GvNaKnO', 'P2pGkpsslL', 'NvrGcR2npg'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, blCDnlN5aw2LgftDY2.cs	High entropy of concatenated method names: 'sjJbBFGs7', 'rj4pypSxr', 'rZeDQ77cn', 'rAMB9sUrE', 'A30ARZ4u7', 'UYEXSrS17', 'uXkQ7dI4E8cViZ1ScI', 'ihfvoSTDHhvJljB0Kq', 'J9n7EOqgG', 'd7YC6W9DO'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, OoOiy3XUylJnXYk2aJ.cs	High entropy of concatenated method names: 'JrpxEY5y53', 'WThxBSXAvl', 'PyG3KdQNVv', 'XEg3VvcDXO', 'Ytc3vGQcCN', 'BmD3kkobU2', 'jdk3c2xSEf', 'u3F3T0CwYf', 'Ltw3flFFZk', 'Duc3Fl4i46'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, T4MYihU2jTbHZyP9hj.cs	High entropy of concatenated method names: 'AAjhoMgorH', 'bI0hWpRlfO', 'ST2h0PYG1L', 'MNih32ZIyu', 'oVwhxlxglw', 'sI4hZkDFpv', 'QfKh8RD9Tu', 'U4XhU2OIHX', 'a0rhPJJaTk', 'RmJh6eVvq4'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, Dd2Bi7JvwPWUxrQeTw.cs	High entropy of concatenated method names: 'm6SMtHkp2K', 'AejMA47DFm', 'ubxMl6icFV', 'ywiMQWmdeN', 'pJRMVg7xjp', 'hRWMvvM1Pr', 'D9XMc9G80J', 'HHCMTpQAHR', 'fYoMFmhp5e', 'coJMeBhc3Q'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, bKGaGCfN9r8b3dAxfR.cs	High entropy of concatenated method names: 'BWh85jVV9w', 'l4t8402TsD', 'U3i8b96aHo', 'eyS8pGBfjH', 'qyM8EUjIQZ', 'GLT8DjxZdi', 'sMH8BOZdEm', 'NkJ8t0HKt1', 'je68AZNDDD', 'iH48XqcaoE'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, psJmfbcnh2UHCfO6X1.cs	High entropy of concatenated method names: 'doi8WEr9EH', 'WiC83D7CGt', 'xLP8Z4u0V8', 'dQZZOU2Bxt', 'THjZzlHolR', 'Hak821U2DW', 'lP28Yeyepr', 'NNy8NwM91q', 'G4r8haSOiV', 'dxr8uWgWUo'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, nlClL9RBjENyMP58Sf.cs	High entropy of concatenated method names: 'ToString', 'euG9e2dejU', 'Utj9QoUb4N', 'LXg9KAVG8L', 'O3D9Va80Ak', 'OtM9vFJWRr', 'Sbq9kP6okc', 'gkX9c4qXrP', 'MP29TAq7Cp', 'SuS9fIIIVn'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, YfCfd4O8KR8Cn3tWPs.cs	High entropy of concatenated method names: 'x34C31kRmi', 'KfeCxU9JBD', 'yObCZKn68F', 'fKsC8DdcLP', 'eWXCyk7Ysm', 'AsdCUju54q', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, MKu06VYhTUgWX8T7pex.cs	High entropy of concatenated method names: 'IgHrOG1xwL', 'TJZrz8Uc9u', 'Xftg2BptFh', 'AxRuDZHPEhewdED7evS', 'nLXmqPHdwlEaly45t7y', 'u159PWHH02DLxmNGMEn', 'vdW1SgHK0WCWLquc8iu'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, EBoOdSlDPIU1RApnZW.cs	High entropy of concatenated method names: 'mtkZovqfLX', 'wCEZ00W1Y8', 'b4dZxQIqrY', 'OBIZ85XOT0', 't8pZUMqrA3', 'EsMx1Tm4XQ', 'MSAxjBM9Ha', 'E1sxIgGVdR', 'MEVxLaQr0Q', 'CvRxq6FcG2'
Source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, W3NEvE0F9vk3mc0EGh.cs	High entropy of concatenated method names: 'Dispose', 'wI4YqGaRjO', 'DN4NQALee0', 'DwOCGjEhbn', 'FaXYOlPf4U', 'NT8YzIB8jv', 'ProcessDialogKey', 'GU7N210FOI', 'hRwNYJJSDB', 'B6TNNOfCfd'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, s3M8YEIWMsI4GaRjOl.cs	High entropy of concatenated method names: 'bugyGBoTgU', 'WGqynxvpqV', 'Y65yykZFHl', 'Bw1yrK8Sda', 'wQdyS3WG8L', 'yUfyHmPour', 'Dispose', 'xm97W2QMaX', 'MQI70HKbc0', 'ftQ73CAtHG'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, hRi78eY2vqba3sjOFgE.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'I9ECeMD3Be', 'V7uCmdZEVp', 'DUACJqGCPo', 'zGBCaJLRaI', 'e2UCweY0vY', 'B5mCRL99YO', 'basCiefJ48'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, eV2UW4jMaGcT6OE5sg.cs	High entropy of concatenated method names: 'SGunLTe1Ci', 'j7qnOu7cyQ', 'SIw72kttqG', 'aMw7YWFGKM', 'OPxneH03Rd', 'tRfnmu29hG', 'oG3nJ43Uu3', 'ffvnay4Otc', 'U01nwdlkB7', 'vlcnReSL8C'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, AhqLRAzDifvQitaSMY.cs	High entropy of concatenated method names: 'DCFCDWkHne', 'aXuCtm2uA0', 'syxCAUKMAw', 'nkHCl5SYBX', 'J5QCQIT6kv', 'kniCVfuZ7R', 'BgkCvf2jmp', 'C8NCH66Sd0', 'mpWC5t7OQe', 'uKEC4rx5Q4'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, KY302Gupdo3G84DdV4.cs	High entropy of concatenated method names: 'bXdY8W3n9D', 'sUKYUVoFXJ', 'ssLY6YVfId', 'jX6YddeoOi', 'bk2YGaJABo', 'YdSY9DPIU1', 'NILI6LxygqnmD3FF7L', 'Ywwe2RJBb2JYGBoSb6', 'eTBYYye0Wr', 'O7eYhisBv7'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, nW3n9DtCUKVoFXJXYL.cs	High entropy of concatenated method names: 'ItS0a5Vmaf', 'NM30wMKDOW', 'A3D0RdZ0pm', 'uxH0iEAGsA', 'UOZ014kgnD', 'rci0j7Cmp3', 'IPa0IoI4jD', 'jFl0LRRsru', 'sR90qOhksn', 'Pj80OInC4h'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, r10FOIq3RwJJSDBE6T.cs	High entropy of concatenated method names: 'HDpyloxufv', 'UXbyQr7Exk', 'uV9yKNI40X', 'ONcyVAUINA', 'DLoyv6KpFC', 'F6Gyk4HyUT', 'C7OycQvjwd', 'nNKyT9JaaA', 'JY0yfaoaSS', 'qQOyF5ZlyA'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, ak9TLTYYo3XPXTuLLCn.cs	High entropy of concatenated method names: 'xNYCOKTpuf', 'zvTCz9VAKk', 'TQMr2AXJ8U', 'CV9rYJ2GvD', 'afqrNn5Qxd', 'tI8rhCSCmE', 'pl5ruDHxHN', 'uB7roHWyaD', 'Jo6rWOwvyI', 'GNBr0HYXa1'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, zYIKPrYuoh0gmw1dmks.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tRLgyXWa0d', 'lGfgCRuOBk', 'lxwgrgl0Cw', 'XJvggt3EmU', 'sH8gSFkv16', 'kxVgs4W9Be', 'hcjgHVdmaL'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, aQHQCCAsLYVfId8X6d.cs	High entropy of concatenated method names: 'svN3pGU1xV', 'GZH3Dwkw0K', 'Yi73tbOLXZ', 'MMe3AyhHyN', 'a383GIXmrL', 'afr39fbhNy', 'jJb3nU6p31', 'wrs37kjo6t', 'd7H3yCIgCQ', 'k943CsXx3f'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, raUZwtankETy9DHvxq.cs	High entropy of concatenated method names: 'XhrGFsC4wL', 'vBAGmH8YWu', 'Qw6Ga2sDav', 'FA6GwG9cYM', 'GpXGQ1PsPR', 'BMRGKj6HGB', 'qypGVSmjYs', 'U58GvNaKnO', 'P2pGkpsslL', 'NvrGcR2npg'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, blCDnlN5aw2LgftDY2.cs	High entropy of concatenated method names: 'sjJbBFGs7', 'rj4pypSxr', 'rZeDQ77cn', 'rAMB9sUrE', 'A30ARZ4u7', 'UYEXSrS17', 'uXkQ7dI4E8cViZ1ScI', 'ihfvoSTDHhvJljB0Kq', 'J9n7EOqgG', 'd7YC6W9DO'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, OoOiy3XUylJnXYk2aJ.cs	High entropy of concatenated method names: 'JrpxEY5y53', 'WThxBSXAvl', 'PyG3KdQNVv', 'XEg3VvcDXO', 'Ytc3vGQcCN', 'BmD3kkobU2', 'jdk3c2xSEf', 'u3F3T0CwYf', 'Ltw3flFFZk', 'Duc3Fl4i46'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, T4MYihU2jTbHZyP9hj.cs	High entropy of concatenated method names: 'AAjhoMgorH', 'bI0hWpRlfO', 'ST2h0PYG1L', 'MNih32ZIyu', 'oVwhxlxglw', 'sI4hZkDFpv', 'QfKh8RD9Tu', 'U4XhU2OIHX', 'a0rhPJJaTk', 'RmJh6eVvq4'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, Dd2Bi7JvwPWUxrQeTw.cs	High entropy of concatenated method names: 'm6SMtHkp2K', 'AejMA47DFm', 'ubxMl6icFV', 'ywiMQWmdeN', 'pJRMVg7xjp', 'hRWMvvM1Pr', 'D9XMc9G80J', 'HHCMTpQAHR', 'fYoMFmhp5e', 'coJMeBhc3Q'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, bKGaGCfN9r8b3dAxfR.cs	High entropy of concatenated method names: 'BWh85jVV9w', 'l4t8402TsD', 'U3i8b96aHo', 'eyS8pGBfjH', 'qyM8EUjIQZ', 'GLT8DjxZdi', 'sMH8BOZdEm', 'NkJ8t0HKt1', 'je68AZNDDD', 'iH48XqcaoE'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, psJmfbcnh2UHCfO6X1.cs	High entropy of concatenated method names: 'doi8WEr9EH', 'WiC83D7CGt', 'xLP8Z4u0V8', 'dQZZOU2Bxt', 'THjZzlHolR', 'Hak821U2DW', 'lP28Yeyepr', 'NNy8NwM91q', 'G4r8haSOiV', 'dxr8uWgWUo'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, nlClL9RBjENyMP58Sf.cs	High entropy of concatenated method names: 'ToString', 'euG9e2dejU', 'Utj9QoUb4N', 'LXg9KAVG8L', 'O3D9Va80Ak', 'OtM9vFJWRr', 'Sbq9kP6okc', 'gkX9c4qXrP', 'MP29TAq7Cp', 'SuS9fIIIVn'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, YfCfd4O8KR8Cn3tWPs.cs	High entropy of concatenated method names: 'x34C31kRmi', 'KfeCxU9JBD', 'yObCZKn68F', 'fKsC8DdcLP', 'eWXCyk7Ysm', 'AsdCUju54q', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, MKu06VYhTUgWX8T7pex.cs	High entropy of concatenated method names: 'IgHrOG1xwL', 'TJZrz8Uc9u', 'Xftg2BptFh', 'AxRuDZHPEhewdED7evS', 'nLXmqPHdwlEaly45t7y', 'u159PWHH02DLxmNGMEn', 'vdW1SgHK0WCWLquc8iu'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, EBoOdSlDPIU1RApnZW.cs	High entropy of concatenated method names: 'mtkZovqfLX', 'wCEZ00W1Y8', 'b4dZxQIqrY', 'OBIZ85XOT0', 't8pZUMqrA3', 'EsMx1Tm4XQ', 'MSAxjBM9Ha', 'E1sxIgGVdR', 'MEVxLaQr0Q', 'CvRxq6FcG2'
Source: 0.2.DHL Delivery Invoice.exe.9d70000.6.raw.unpack, W3NEvE0F9vk3mc0EGh.cs	High entropy of concatenated method names: 'Dispose', 'wI4YqGaRjO', 'DN4NQALee0', 'DwOCGjEhbn', 'FaXYOlPf4U', 'NT8YzIB8jv', 'ProcessDialogKey', 'GU7N210FOI', 'hRwNYJJSDB', 'B6TNNOfCfd'

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

File created: C:\Users\user\AppData\Roaming\LIWBHGsz.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: DHL Delivery Invoice.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIWBHGsz.exe PID: 2852, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 5090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 6090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 61C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 71C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: B3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: C3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: C840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: D840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory allocated: DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 2E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 3100000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 2E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 5640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 6640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 6770000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 7770000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: B580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: C580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: CA10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 3050000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 3110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory allocated: 5110000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3938	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5962	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 613	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Window / User API: threadDelayed 3434	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Window / User API: threadDelayed 6426	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Window / User API: threadDelayed 2037
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Window / User API: threadDelayed 7784

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 6752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 348	Thread sleep count: 3938 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 708	Thread sleep count: 170 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5052	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98685s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -98019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97357s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -96047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95936s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95597s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -95047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -94936s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -94718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe TID: 7340	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7308	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99625s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99516s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99391s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99266s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99157s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -99032s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98907s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98797s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98688s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98563s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98438s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98313s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98188s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -98079s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97954s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97829s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97704s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97579s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97454s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97329s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97204s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -97079s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96954s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96829s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96704s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96579s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96454s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96329s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96204s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -96079s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95954s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95829s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95704s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95579s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95454s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95329s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95204s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -95079s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94954s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94829s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94704s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94579s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94454s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94329s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94204s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -94079s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe TID: 7556	Thread sleep time: -93954s >= -30000s

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99561	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98685	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 98019	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97905	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97357	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97249	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96593	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 96047	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95936	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95597	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 95047	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 94936	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 94718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99625
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99516
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99391
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99266
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99157
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 99032
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98907
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98797
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98688
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98563
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98438
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98313
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98188
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 98079
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97954
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97829
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97704
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97579
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97454
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97329
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97204
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 97079
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96954
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96829
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96704
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96579
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96454
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96329
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96204
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 96079
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95954
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95829
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95704
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95579
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95454
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95329
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95204
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 95079
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94954
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94829
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94704
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94579
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94454
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94329
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94204
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 94079
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Thread delayed: delay time: 93954

Source: DHL Delivery Invoice.exe, 00000009.00000002.4257955179.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4257158218.000000000134B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Memory written: C:\Users\user\Desktop\DHL Delivery Invoice.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Memory written: C:\Users\user\AppData\Roaming\LIWBHGsz.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Users\user\Desktop\DHL Delivery Invoice.exe "C:\Users\user\Desktop\DHL Delivery Invoice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Process created: C:\Users\user\Desktop\DHL Delivery Invoice.exe "C:\Users\user\Desktop\DHL Delivery Invoice.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp"
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Process created: C:\Users\user\AppData\Roaming\LIWBHGsz.exe "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Users\user\Desktop\DHL Delivery Invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Users\user\Desktop\DHL Delivery Invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Users\user\AppData\Roaming\LIWBHGsz.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Users\user\AppData\Roaming\LIWBHGsz.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 10.2.LIWBHGsz.exe.4909990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4909990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4b6ace8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Delivery Invoice.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Delivery Invoice.exe PID: 2032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIWBHGsz.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIWBHGsz.exe PID: 7436, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4335828.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.79a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.79a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4335828.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1843513866.00000000079A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1828601395.0000000004318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\DHL Delivery Invoice.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\LIWBHGsz.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 14.2.LIWBHGsz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4909990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4909990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4b6ace8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4254539671.0000000000437000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Delivery Invoice.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Delivery Invoice.exe PID: 2032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIWBHGsz.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIWBHGsz.exe PID: 7436, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 10.2.LIWBHGsz.exe.4909990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4909990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4b6ace8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.LIWBHGsz.exe.4b6ace8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.45f9b08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.457ace8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Delivery Invoice.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Delivery Invoice.exe PID: 2032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIWBHGsz.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIWBHGsz.exe PID: 7436, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4335828.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.79a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.79a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4335828.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1843513866.00000000079A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1828601395.0000000004318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 0.2.DHL Delivery Invoice.exe.4355848.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL Delivery Invoice.exe	53%	ReversingLabs	Win32.Trojan.CrypterX
DHL Delivery Invoice.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\LIWBHGsz.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\LIWBHGsz.exe	53%	ReversingLabs	Win32.Trojan.CrypterX

Source	Detection	Scanner	Label
http://crl.gl0	0%	Avira URL Cloud	safe
http://crl.gls	0%	Avira URL Cloud	safe
http://ocsp2.globa	0%	Avira URL Cloud	safe
http://crl.gl(	0%	Avira URL Cloud	safe
http://secure.globalsh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
smtp.yandex.ru	77.88.21.158	true	false	high
api.ipify.org	104.26.12.205	true	false	high
smtp.yandex.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vimeo.com/api/v2/video/	DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/_prof_basesDataSet.xsd	LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4254539671.0000000000435000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vimeo.com/api/v2/album/	DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vimeo.com/api/v2/	DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vimeo.com/api/v2/activity/	LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vimeo.com/api/v2/channel/	LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://smtp.yandex.com	DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002922000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.0000000002CC3000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.000000000290C000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003469000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.000000000350E000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003223000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.00000000035AF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.gls	LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	DHL Delivery Invoice.exe, 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4254547194.0000000000433000.00000040.00000400.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.gl0	DHL Delivery Invoice.exe, 00000009.00000002.4276985451.0000000006311000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/_prof_basesDataSet1.xsd	LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.gl	DHL Delivery Invoice.exe, 00000009.00000002.4282180177.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4256698207.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4289247854.0000000009561000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4277773414.0000000006AB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.gl(	LIWBHGsz.exe, 0000000E.00000002.4277374146.0000000006A87000.00000004.00000020.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp2.globa	LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vimeo.com/api/v2/group/	DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://secure.globalsh	LIWBHGsz.exe, 0000000E.00000002.4288667940.0000000009508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DHL Delivery Invoice.exe, 00000000.00000002.1826460252.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, DHL Delivery Invoice.exe, 00000009.00000002.4259345206.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000A.00000002.1877902419.0000000003109000.00000004.00000800.00020000.00000000.sdmp, LIWBHGsz.exe, 0000000E.00000002.4259229208.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	DHL Delivery Invoice.exe, 00000000.00000002.1845962823.0000000009122000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
77.88.21.158	smtp.yandex.ru	Russian Federation		13238	YANDEXRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564050
Start date and time:	2024-11-27 19:14:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL Delivery Invoice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 181 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: DHL Delivery Invoice.exe

Simulations

Behavior and APIs

Time	Type	Description
13:15:12	API Interceptor	7820132x Sleep call for process: DHL Delivery Invoice.exe modified
13:15:13	API Interceptor	40x Sleep call for process: powershell.exe modified
13:15:17	API Interceptor	5431531x Sleep call for process: LIWBHGsz.exe modified
18:15:13	Task Scheduler	Run new task: LIWBHGsz path: C:\Users\user\AppData\Roaming\LIWBHGsz.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
77.88.21.158	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse
	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.yandex.ru	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse	77.88.21.158
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse	77.88.21.158
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
api.ipify.org	AID0109FLT24DO53CD-F.pdf	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://u48346967.ct.sendgrid.net/ls/click?upn=u001.A0zc-2BEvyk1Wl-2FMpdhEZeKOri2-2FGgH2RTzsX65VEcnN5SaLyl0UT8OMFIJrPp3PpoUM6xY28FQ2N7ftppG5RudDteJXD3BQZCthiPi2c2ALFGlSPfhe-2FcxhcglgWUQb-2BQESuvSP1z-2Bm6yiScj3t94MRtf0LYKB9CrrSBugAIE2LYG8LmYpSkH60B-2FMZ3-2BrvjbSA4-2FMKq-2BcyWHr8EPqNcLYpXKIa0eXlisYAn-2BUQ7zduW7tl-2BbLdZxK7-2F64kDFJWjAhA5-2BQkfVJJJox5IXYuhbutR70TtJJBVXs1-2BGpCmHbl-2BDNTOjQhDGBdV0GcWgnTqzbjbnvsgf-2Be0TXvdX5Smk9Cf3e70Q9X7CCHEUK7n5Iz83JVMEOM-2Fand-2B23jD1RrWlwwdn356TAiWPO93YBbqf0SO77Y7wdjJ1b9FY9HkvpCMIajIk8oGDIkalcOsvDrkfpAsNhyAACh29yO16Fg-2FM5u3K-2FXbE9Ex7FVSxGjaaC9sm3ZFKCHARATSNuZ5Fje0JCvs-2FuHNf8MhNMkgfl0FBuxcFtouETvn8R0InFl5AtNwGS6Afu60jlKV5PLEF8GeumMl4Zuoh2K-2F2yPQclKc1crfKqXCOnUQUzOQ7UyIpV0r3b47s6ht1AVAEPjV3zoZw9RLpCyXdGkoI8n06eY007Qg9WwLvy7We-2BQcl-2FyYQ4K56RiNFy6ideRccN4rvz5rlbEO4SM2GPwiXl06aWh1Z8A-3D-3DayVm_7jfNTkQybv-2BVetjXJenftZxQwKjBczDJqHH7EaznqVv3v2Dkt-2FIgZwJNXIp-2FyMqSeIPtfO34Zh0BJrBXMe8iDwc4F5cynKVd9U-2BCWNvBhYWndn5YPpcrm9EU-2BINyUV9MYoGCAzxOgZamtaAmmSvzUZGau9tG0E7vfYFw2WK2ssr4DmY5GXF-2BgMFUeEjp9HrYndaGnf0PXO4kOxtTViX7PlJWm1KFcSCvZKxLAfO2BkacR3B5XEdLDYpCUp92-2FH-2FHkhtVIRx1yIxGh6p91O9ZVon-2F9iC9RT46lS0PoWolD8OcxI1a8fShT6Hp4QWQfdHwSEy80yGx3wt6ImkGF4v9TXkQs-2Fsq-2FVFPoSnqaJLrItk8v5xWRdhyDRHKG-2BDTjP6JA9QphZ2npWlpDplGG-2B7VPrWDZBnEu36loOA6wRajUleT-2BwoMeGN4STY52Ur27KRveKCJr82irXKChZwqe-2BaUbmDOUwyLdpuYgAFKsd-2BPzSGCG9KIfFEO3qjrRe-2Ft9WxzxVxFb7rM1MFj1q2QSoqqpSZyyIO6o9dQWLpdkFrZCNwiV9o0NuRkda7B0vqLodHzU4jQ4E2ZVSRC2Gc87k08fCi-2BBF7Dmw-2F3-2FQYcQ-2BUHjUCqjlkaHmxOAI7-2FhdUS1Wb7BgsTAm-2Ft-2BvXBxupXitGd4JcEDUe0WuuxdFLUCWiEzHEB6DI0pZnKp0MjuL6t-2FHdSSyJSuzZQLJWoI1iWOBow7nssQ-2FtT6mq0c4kg9bIepJUAi8J12B9eClWiTZDtbREopSTPA0TrHAq8mBDFqCQ0MfGj13zUsahv2EEEPM5XcF8DfOVu-2BwcjmThtw28U2MS5BiDqE1Pwg-2BCEH40qmpHlF5lcXadw9ehGsQbMKc0VYqPjH2-2BLldks6uo-2Fln-2BeeieWNP8wXJfHHwtYJznNHWBqLw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25SERIAL%2525wDnNeW8yycT&sa=t&esrc=nNeW8F%25SERIAL%2525A0xys8Em2FL&source=&cd=tS6T8%25SERIAL%2525Tiw9XH&cad=XpPkDfJX%25SERIAL%2525VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/www.monument-funerar.ro/admin/view/image/payment/#test@example.de	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, PureLog Stealer, RedLine, XWorm	Browse	104.26.12.205
	INVITATION TO BID as on 25 NOV 2024.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	104.26.13.205
	2jbMIxCFsK.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	Packing List - SAPPHIRE X.xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	https://app.useblocks.io/getemail/48034?secret_hash=d1541dc5be135b2d0f39c0711cecbe46&raw=true	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	TNT Express Delivery Consignment AWD 87993766479.vbs	Get hash	malicious	FormBook	Browse	172.67.162.12
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.160.80
	https://michiganchronicle.com/philanthropy-under-siege-how-the-fight-against-the-fearless-fund-threatens-black-womens-progress-in-detroit/	Get hash	malicious	Unknown	Browse	104.26.10.19
	Siparis po 1198624 _#U0130zmir #U0130stinyepark Projesi.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	https://antiphishing.vadesecure.com/v4?f=U3NocHNZUmllMWk0MmdjMYDgQ0wsRYjjfDkZnUsmsqS3bv-gdJZTKaN5KSsipRTf&i=cnNwakphM05sN25WcmhxVcUfrB8NjiRd7gd4RsoOTL4&k=A3pt&r=UUJQWml1Y2NtejlnWDZLZB0Eg6oPQLWHk5a0M-cKRXyoaPvtU4tInW_VqCgS4DhSa_cUZCcNAUmWLKbw9MOxGw&s=bf71d8ade961f6ab439c8235babb7157b334d689888d3083d0cc1744cfe48aaf&u=https%3A%2F%2Fpublic-fra.mkt.dynamics.com%2Fapi%2Forgs%2F85a8c477-bea7-ef11-8a66-0022483994f9%2Fr%2FMKSqoVs73k-RUO5uHPfRswIAAAA%3Ftarget%3D%257B%2522TargetUrl%2522%253A%2522https%25253A%25252F%25252Fassets-fra.mkt.dynamics.com%25252F85a8c477-bea7-ef11-8a66-0022483994f9%25252Fdigitalassets%25252Fstandaloneforms%25252F46042089-b8ac-ef11-a72d-6045bd6e29e8%2522%252C%2522RedirectOptions%2522%253A%257B%25226%2522%253A%2522mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%2522%252C%25221%2522%253Anull%257D%257D%26digest%3Djuexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%253D%26secretVersion%3D02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	172.67.215.61
	https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.org	Get hash	malicious	Unknown	Browse	172.67.191.170
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.82.174
	https://98dm.oyvysi.com/pNP5FoexU0Zwq_iRmrJnKFv/	Get hash	malicious	Unknown	Browse	104.21.67.123
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	REMITTANCE_PAYMENT54342Saic.html	Get hash	malicious	Phisher	Browse	104.21.20.53
YANDEXRU	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	100.43.91.146
	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	77.88.21.119
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	5.45.222.189
	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	http://www.tqltrax.com	Get hash	malicious	Unknown	Browse	87.250.251.119
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse	77.88.21.158
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse	77.88.21.158

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	faktura461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.26.12.205
	document.vbs	Get hash	malicious	Unknown	Browse	104.26.12.205
	Siparis po 1198624 _#U0130zmir #U0130stinyepark Projesi.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	https://antiphishing.vadesecure.com/v4?f=U3NocHNZUmllMWk0MmdjMYDgQ0wsRYjjfDkZnUsmsqS3bv-gdJZTKaN5KSsipRTf&i=cnNwakphM05sN25WcmhxVcUfrB8NjiRd7gd4RsoOTL4&k=A3pt&r=UUJQWml1Y2NtejlnWDZLZB0Eg6oPQLWHk5a0M-cKRXyoaPvtU4tInW_VqCgS4DhSa_cUZCcNAUmWLKbw9MOxGw&s=bf71d8ade961f6ab439c8235babb7157b334d689888d3083d0cc1744cfe48aaf&u=https%3A%2F%2Fpublic-fra.mkt.dynamics.com%2Fapi%2Forgs%2F85a8c477-bea7-ef11-8a66-0022483994f9%2Fr%2FMKSqoVs73k-RUO5uHPfRswIAAAA%3Ftarget%3D%257B%2522TargetUrl%2522%253A%2522https%25253A%25252F%25252Fassets-fra.mkt.dynamics.com%25252F85a8c477-bea7-ef11-8a66-0022483994f9%25252Fdigitalassets%25252Fstandaloneforms%25252F46042089-b8ac-ef11-a72d-6045bd6e29e8%2522%252C%2522RedirectOptions%2522%253A%257B%25226%2522%253A%2522mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%2522%252C%25221%2522%253Anull%257D%257D%26digest%3Djuexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%253D%26secretVersion%3D02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.org	Get hash	malicious	Unknown	Browse	104.26.12.205
	Payment_Slip.pdf.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Banorte_Aviso_de_Pago_pdf.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	New_June_Inquiry_List_pdf.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Jordan Kuwait Bank _ Payment Advice MT103.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Payment_Slip.pdf.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\DHL Delivery Invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	5.35299682261553
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HKHKMR5vzHKnHKU57Uy:Pq5qHwCYqh3oPtI6eqzxqqMR5rqnqU5t
MD5:	4D047149BCD6E4625565C631F1F723B2
SHA1:	33909516B8ACB42E0B7E5E7D48F8B2D917094BCB
SHA-256:	E84139F7D948F47ADF2E6346641261ADED096D1DB640EFF9B9B7D122121685DC
SHA-512:	AE0D2AC2C282AEBA1B63851529892240C3BE5D56F3996F1BEE3263FBB13A7A044348D63F04B0705836C5847994BD553F342511F6BB4DD075E4E8A3E9CB12D54F
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LIWBHGsz.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\LIWBHGsz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	5.35299682261553
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HKHKMR5vzHKnHKU57Uy:Pq5qHwCYqh3oPtI6eqzxqqMR5rqnqU5t
MD5:	4D047149BCD6E4625565C631F1F723B2
SHA1:	33909516B8ACB42E0B7E5E7D48F8B2D917094BCB
SHA-256:	E84139F7D948F47ADF2E6346641261ADED096D1DB640EFF9B9B7D122121685DC
SHA-512:	AE0D2AC2C282AEBA1B63851529892240C3BE5D56F3996F1BEE3263FBB13A7A044348D63F04B0705836C5847994BD553F342511F6BB4DD075E4E8A3E9CB12D54F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//ZmUyus:fLHxvIIwLgZ2KRHWLOuggs
MD5:	1F07DBFC960DDEA7295F1A6FD48057B1
SHA1:	05F3052BCC168B834CEA8EA48E050020C5CAD8F5
SHA-256:	72F8629C56744FE3E1E3C1B705EF6355E59E5C96B4924427EE430C9F9EF46809
SHA-512:	D94DF9A81FAF494891837FA73FECEF1D8226E18978A2EEA534409724409E13C6DACAB32E00C494FB2A140573E1C152EE407A0E070515B3802A06649690B1C491
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_22cz4tvm.3ai.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgyrvunt.s1o.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocqnukxp.kmd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oga4e2tx.x1a.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pa00wwmt.5p0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qik2rph4.ezo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qim5ulos.tk0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r33wqbcv.5wn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpC314.tmp

Download File

Process:	C:\Users\user\Desktop\DHL Delivery Invoice.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.1145737739774875
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtafHxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTYRv
MD5:	98D336C96FE40FD34BACA1842B429BB9
SHA1:	FB7BA442BC73A7A24C2ED56D20AEFB5950BE1D04
SHA-256:	D4F31E20B646DC589867AE016E5F89CC2EC56CD5240728FCEB25AF0B1D3B3C34
SHA-512:	4449511FBB1E66F0646807D2626D966BB3AE134CB70AA982327D5917A9312D9FEA733C13CD1CC5C0642A790875DA87D1257CC16841FB686786A2B7A081854FE7
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LIWBHGsz.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.1145737739774875
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtafHxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTYRv
MD5:	98D336C96FE40FD34BACA1842B429BB9
SHA1:	FB7BA442BC73A7A24C2ED56D20AEFB5950BE1D04
SHA-256:	D4F31E20B646DC589867AE016E5F89CC2EC56CD5240728FCEB25AF0B1D3B3C34
SHA-512:	4449511FBB1E66F0646807D2626D966BB3AE134CB70AA982327D5917A9312D9FEA733C13CD1CC5C0642A790875DA87D1257CC16841FB686786A2B7A081854FE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\LIWBHGsz.exe

Download File

Process:	C:\Users\user\Desktop\DHL Delivery Invoice.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1000448
Entropy (8bit):	7.465213437585276
Encrypted:	false
SSDEEP:	24576:YCokCSN9N5mSXYodhsVQ2FGnTM8NUFBl6TP:Bokn5mSXbhmQ2FGTM8q6TP
MD5:	9AF85D4623CAFA79192F542727A6E923
SHA1:	3739DBEEEC123626E43210A4DAF52D07B2A4247E
SHA-256:	320BF0A79235FDBFD5D1ADADCFC530E134D9CF3AA67BFB5C63DFDDBC3BB3963F
SHA-512:	AC7022AAA01FB838F8E61FADFF6BFCD1071812AA9048ED9FBC176A4E45C589C0095B976CF8255643D7F8C8483EBBB70ED6B72BCEAA4E4333CD3D5399EBCD1C14
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bFg..............0.............H... ...`....@.. ....................................@.................................lH..O....`.. ............................................................................ ............... ..H............text....(... ..................... ..`.rsrc... ....`.......,..............@..@.reloc...............B..............@..B.................H......H.......................U...g..........................................N.'=d.1o..)..+....DH....."Y....v...=o.\.1.SL..g .N{{j.0....h...9a).O......+........m.-...E...7}..7.....N~.C.Z~..ES"X...l.;\.zPv......9S.n..3......lm.ln..L...8,X.gD....X...%.Hfu.m.@...^....z(.o........V.....&..RV.....\|)V{....A..4s.M...t....7$o(#..s.../t,...Ku?g..N\|5.....)...n.....OC.....3...$..]$......Y.N..u..5.>..5d[..SkOQ._{t.nIU\|...P..?..U............o...~+....fx.h*.M...J.]...(

C:\Users\user\AppData\Roaming\LIWBHGsz.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DHL Delivery Invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.465213437585276
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	DHL Delivery Invoice.exe
File size:	1'000'448 bytes
MD5:	9af85d4623cafa79192f542727a6e923
SHA1:	3739dbeeec123626e43210a4daf52d07b2a4247e
SHA256:	320bf0a79235fdbfd5d1adadcfc530e134d9cf3aa67bfb5c63dfddbc3bb3963f
SHA512:	ac7022aaa01fb838f8e61fadff6bfcd1071812aa9048ed9fbc176a4e45c589c0095b976cf8255643d7f8c8483ebbb70ed6b72bceaa4e4333cd3d5399ebcd1c14
SSDEEP:	24576:YCokCSN9N5mSXYodhsVQ2FGnTM8NUFBl6TP:Bokn5mSXbhmQ2FGTM8q6TP
TLSH:	95258C983210B19FC857C9728964DD74E6606CAA930BD303A1E759EFFD0E59BDE140F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bFg..............0..*...........H... ...`....@.. ....................................@................................

File Icon


Icon Hash:	53084c444c441845

Static PE Info

General

Entrypoint:	0x4f48be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674662C8 [Wed Nov 27 00:07:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf486c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf6000	0x1520	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf28c4	0xf2a00	b469a44186b250cddaacb7fb878a9a35	False	0.7769191138588356	data	7.469334701221808	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf6000	0x1520	0x1600	4e4553b043c291adb7ae5eea1900bac8	False	0.7562144886363636	data	6.977709123114407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf8000	0xc	0x200	4f0228de4f34f502e364ae9eba53014b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf6130	0xfbe	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.892803970223325
RT_GROUP_ICON	0xf70f0	0x14	data	1.05
RT_VERSION	0xf7104	0x22c	data	0.49640287769784175
RT_MANIFEST	0xf7330	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 19:15:14.970927954 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:14.970972061 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:14.971153975 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:14.982647896 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:14.982670069 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:16.274735928 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:16.274846077 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:16.279301882 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:16.279321909 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:16.279638052 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:16.374494076 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:16.443440914 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:16.491327047 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:16.785274029 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:16.785341978 CET	443	49733	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:16.785415888 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:16.791815996 CET	49733	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:18.311512947 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:18.432379961 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:18.432545900 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:19.478491068 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:19.478549957 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:19.478655100 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:19.503742933 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:19.503771067 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:19.784538984 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:19.788817883 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:19.908952951 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:20.241609097 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:20.241791964 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:20.367666006 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:20.700320005 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:20.700835943 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:20.768886089 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:20.768968105 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:20.771281004 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:20.771295071 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:20.771647930 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:20.886841059 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:20.929698944 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:20.960513115 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:20.971335888 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:21.294713020 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.294845104 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.294857025 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.294910908 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:21.295288086 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.295352936 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:21.298644066 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:21.298728943 CET	443	49737	104.26.12.205	192.168.2.4
Nov 27, 2024 19:15:21.298866987 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:21.299024105 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:21.301547050 CET	49737	443	192.168.2.4	104.26.12.205
Nov 27, 2024 19:15:21.452250957 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.784466982 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.788042068 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:21.856200933 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:21.913338900 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.987261057 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:21.987473965 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:22.245820999 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:22.246975899 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:22.378475904 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:22.709844112 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:22.710127115 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:22.843816042 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:23.332796097 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:23.333081007 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:23.454730988 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:23.552289963 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:23.554558992 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:23.699120045 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:23.803169966 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:23.803405046 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:23.928072929 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.041109085 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.041301966 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:24.303024054 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.370984077 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.371203899 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:24.514043093 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.642561913 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.646672010 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:24.797621965 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.846036911 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.848651886 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:24.848712921 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:24.848731041 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:24.848747969 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:24.974776983 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.974814892 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.974823952 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:24.974836111 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:25.138978958 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:25.139090061 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:25.139105082 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:25.139167070 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:25.139583111 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:25.140017986 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:25.141544104 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:25.283777952 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:25.623629093 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:25.637624979 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:25.926453114 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:26.024213076 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:26.074389935 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:26.108777046 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:26.109174013 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:26.305171013 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:26.647727013 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:26.648104906 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:26.821324110 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:27.198755026 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:27.199034929 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:27.353480101 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:27.713582039 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:27.713826895 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:27.834794044 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:28.275034904 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:28.275240898 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:28.497443914 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:28.836848021 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:28.837738991 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:28.837807894 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:28.837821960 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:28.837861061 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:15:28.981385946 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:28.984863043 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:28.984903097 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:28.984915018 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:29.998846054 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:15:30.043137074 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:33.897849083 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:34.019594908 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:34.352909088 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:34.352931023 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:34.353164911 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:34.353527069 CET	49735	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:34.354939938 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:34.603018999 CET	587	49735	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:34.603032112 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:34.603113890 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:35.989707947 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:35.989877939 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:36.122745037 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:36.458970070 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:36.460949898 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:36.581135988 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:36.917356968 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:36.917807102 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:37.044136047 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:37.382329941 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:37.382502079 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:37.382514954 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:37.382589102 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:37.383014917 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:37.384706974 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:37.387521029 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:37.509788990 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:37.846482038 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:37.855959892 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:37.990036011 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:38.326464891 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:38.326879978 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:38.453915119 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:38.790390015 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:38.790705919 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:38.910840988 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:39.266393900 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:39.270910978 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:39.394813061 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:39.735235929 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:39.735488892 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:39.862345934 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.293982029 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.298116922 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.419622898 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.756115913 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.757766962 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.757884026 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.757884026 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.758119106 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.759294987 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.878010988 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.878058910 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.878072977 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.878227949 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.893563986 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.893585920 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.893601894 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.893655062 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.893667936 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.893709898 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.893709898 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.893786907 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.914195061 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.914522886 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.944674015 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.944696903 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.944993019 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.983716011 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.983738899 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.984364986 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:40.998256922 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:40.998529911 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.013885975 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.013947010 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.014014006 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.014039040 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.014102936 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.034229040 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.038201094 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.064661026 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.064977884 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.104624987 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.104975939 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.116476059 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.116703987 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.119132996 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.119358063 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.126986027 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.127290010 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.133899927 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.134056091 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.134183884 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.134309053 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.134427071 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:41.154078960 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.184787035 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.224296093 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.239129066 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.247247934 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.254206896 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.254260063 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.254388094 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.275332928 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.305169106 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.344980001 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.345038891 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.345048904 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.361291885 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.361325026 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.369899988 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.369976997 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.376821995 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.376835108 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.376921892 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.376930952 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.376954079 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.377047062 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.397384882 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.397416115 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.426997900 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.427020073 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.427059889 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.469280958 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.469300032 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.472242117 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:41.487178087 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:42.425404072 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:42.466108084 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:44.998780012 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:45.002211094 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:52.547090054 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:52.547090054 CET	49738	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:52.550142050 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:52.691471100 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:52.691559076 CET	587	49738	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:52.691570044 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:52.691987038 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:54.006361008 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:54.007723093 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:54.132108927 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:54.572233915 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:54.572470903 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:54.727978945 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:55.084091902 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:55.086613894 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:55.214426041 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:55.548548937 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:55.548638105 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:55.548650026 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:55.548679113 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:55.549026012 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:55.549069881 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:55.550956011 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:55.677802086 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:56.020292997 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:56.041173935 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:56.172643900 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:56.504304886 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:56.504997015 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:56.627321959 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:56.960175991 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:56.961401939 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:57.088135004 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:57.443466902 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:57.443650007 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:57.571052074 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:57.919815063 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:57.920207024 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.040496111 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.383373022 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.390156984 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.511374950 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.844075918 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.844738960 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.844738960 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.844894886 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.844894886 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.846174002 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.966290951 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.966305971 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.966357946 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.966483116 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.966538906 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.966643095 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.976006985 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.978288889 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.986248970 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.986269951 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.986366987 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.990941048 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.990951061 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.991064072 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.991079092 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.991089106 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.991219997 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:58.991393089 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.991403103 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:58.991451025 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.093285084 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.093426943 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.093575954 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.105346918 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.109194040 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.117691994 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.117829084 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.117957115 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.117993116 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.118149042 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.130664110 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.136193991 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.170617104 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.178179026 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.342365026 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.342428923 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.342448950 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.342509031 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.342727900 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.342787027 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.342910051 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.342959881 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.343000889 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.343046904 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:16:59.343142033 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.343456030 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.343552113 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.343628883 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.343677998 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.363529921 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.368091106 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.381056070 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.425858974 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.462304115 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.462599993 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.462908983 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.462943077 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.484035015 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.484045029 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.488137007 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.488322020 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.501698971 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.501714945 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.545829058 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.545840025 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.545909882 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.569858074 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.569915056 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.582483053 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.582859039 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.604619980 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.604630947 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.604662895 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.608947992 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.609025002 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:16:59.622514963 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:00.424552917 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:00.640322924 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:03.284244061 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:03.404167891 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:03.736423969 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:03.736685991 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:03.736728907 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:03.737293005 CET	49857	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:03.740154028 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:04.030088902 CET	587	49857	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:04.030102015 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:04.030185938 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:05.782105923 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:05.782222986 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:05.902468920 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:06.368886948 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:06.371643066 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:06.530206919 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:06.877026081 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:06.878169060 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:07.030009031 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:07.378082037 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:07.378199100 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:07.378211975 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:07.378248930 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:07.378648996 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:07.378694057 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:07.380584002 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:07.516077995 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:07.863130093 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:07.866014957 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:07.986227989 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:08.091403961 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:08.161283970 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:08.233704090 CET	587	49882	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:08.233762980 CET	49882	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:08.287864923 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:08.288295031 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:09.569925070 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:09.573782921 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:09.694214106 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.028413057 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.028656960 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:10.211822987 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.544131994 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.544528961 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:10.664624929 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.997719049 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.997795105 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.997808933 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:10.997999907 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:11.190195084 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:11.194173098 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:11.314518929 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:11.644793034 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:11.647202969 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:11.773546934 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:12.104135990 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:12.104516029 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:12.224504948 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:12.554831028 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:12.582194090 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:12.706399918 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:13.056360006 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:13.056643963 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:13.194618940 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:13.528793097 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:13.529525995 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:13.682893991 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.168272018 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.168642044 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.295445919 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.625953913 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.634744883 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.634744883 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.634829998 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.635032892 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.638145924 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.795629978 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.795644045 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.795711994 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.801033020 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.801045895 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.801096916 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.803086042 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.803142071 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.803152084 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.803257942 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.807543039 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.807553053 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.807610989 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.807658911 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.807668924 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.807707071 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.807948112 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.817500114 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.817593098 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.844530106 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.844603062 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.930811882 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.930855989 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.935587883 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.935647011 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.938628912 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.938673973 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.945214033 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:14.989396095 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:14.993205070 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:15.134556055 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.134588957 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.134661913 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.134840012 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.135071039 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.135364056 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.135497093 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:15.136116028 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:15.136600971 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.136801004 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.137202978 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:15.149409056 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:15.187613010 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.187674999 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.222944975 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.256990910 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.307425022 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.307460070 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.342626095 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.342726946 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.373517990 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.375405073 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.375457048 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.375555992 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.375595093 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.375719070 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.375771046 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.375883102 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.428978920 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.429001093 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.429352999 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.429579020 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.455019951 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.455178022 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.466856003 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.466943026 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.499438047 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.501113892 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.501182079 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.501374006 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.501405001 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.501990080 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:15.502057076 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:16.280632019 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:16.371541023 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:23.575583935 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:23.709409952 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:24.045577049 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:24.046427011 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:24.048918962 CET	49923	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:24.049154043 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:24.049202919 CET	49820	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:24.166383028 CET	587	49820	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:24.170689106 CET	587	49923	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:24.170758963 CET	49923	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:25.494473934 CET	587	49923	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:25.494637966 CET	49923	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:25.700330973 CET	587	49923	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.031265020 CET	587	49923	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.031404018 CET	49923	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.158574104 CET	587	49923	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.294219971 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.418878078 CET	49923	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.428482056 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.477449894 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.490036964 CET	587	49923	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.490149975 CET	49923	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.548726082 CET	587	49923	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.550019026 CET	49923	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.636548042 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.636647940 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.759222031 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.759613991 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.759846926 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.760260105 CET	49891	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.761080980 CET	49930	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:26.886183977 CET	587	49891	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.915611982 CET	587	49930	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:26.915752888 CET	49930	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:27.043725014 CET	49930	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:27.097876072 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:27.163950920 CET	587	49930	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:27.164107084 CET	49930	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:27.284094095 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:27.284228086 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:28.007865906 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:28.008336067 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:28.145522118 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:28.477503061 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:28.478343010 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:28.545458078 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:28.546442986 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:28.644174099 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:28.679548025 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:28.979640961 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:28.982918978 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.008690119 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.010523081 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.107352018 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.131005049 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.440416098 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.440573931 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.440592051 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.440629005 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.441039085 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.441085100 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.442694902 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.459299088 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.459682941 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.469505072 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.531482935 CET	49938	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.580840111 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.580854893 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.589948893 CET	587	49929	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.590006113 CET	49929	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.651789904 CET	587	49938	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.651881933 CET	49938	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.908919096 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:29.910003901 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:29.912842035 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:30.031390905 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:30.034321070 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:30.535402060 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:30.535746098 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:30.658642054 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:30.778013945 CET	49938	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:30.837829113 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:30.902878046 CET	587	49938	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:30.903143883 CET	49938	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:30.970114946 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:30.970212936 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:30.987154007 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:30.987987041 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:31.153784037 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:31.500890017 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:31.501225948 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:31.628057957 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:31.962276936 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:31.962498903 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.089411020 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.368561029 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.370347023 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.493344069 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.512594938 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.514219999 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.640868902 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.832662106 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.833506107 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.953504086 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.969501972 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:32.970208883 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.970392942 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.970623970 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.970741034 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:32.973820925 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.091411114 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.091424942 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.091533899 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.091763973 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.091934919 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.092045069 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.095175982 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.095186949 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.095196962 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.095218897 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.095228910 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.095246077 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.095266104 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.095266104 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.095340014 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.128967047 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.129127979 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.129237890 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.133744001 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.133851051 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.142226934 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.144746065 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.216039896 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.216151953 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.216360092 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.216468096 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.219719887 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.219885111 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.219911098 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.220300913 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.220371008 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.292459965 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.292923927 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.416834116 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.416898966 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.416920900 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.416961908 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.417653084 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.417661905 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.417711020 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.417732954 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.418083906 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.418138027 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.418608904 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.418656111 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.418936014 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.418981075 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.419202089 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.419245005 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.432908058 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.463432074 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.465864897 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.509571075 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.536999941 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.547281027 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.563627005 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.585272074 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.591543913 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.627859116 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.627919912 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.628226995 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.630415916 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.638433933 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.657258987 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.657270908 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.667566061 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.667855024 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.678750038 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.678785086 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.683760881 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.705172062 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.705365896 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.707653046 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.711630106 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.711798906 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.748217106 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.748250008 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.750135899 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.750152111 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.820782900 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.820821047 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.820833921 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.820884943 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.821252108 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.821288109 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.823889017 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.919842958 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:33.946816921 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:33.985964060 CET	49949	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:34.042900085 CET	587	49942	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:34.042949915 CET	49942	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:34.107558966 CET	587	49949	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:34.107666016 CET	49949	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:34.534337997 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:34.684097052 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:35.433774948 CET	587	49949	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:35.433888912 CET	49949	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:35.580995083 CET	587	49949	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:35.606215954 CET	49949	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:35.680211067 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:35.728272915 CET	587	49949	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:35.728324890 CET	49949	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:35.800479889 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:35.800563097 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:37.101612091 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:37.102360964 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:37.240554094 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:37.561805010 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:37.561934948 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:37.681912899 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.003779888 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.004287004 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:38.130763054 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.454283953 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.454482079 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.454495907 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.454556942 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:38.454978943 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.455101967 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:38.456705093 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:38.725521088 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:38.734244108 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:38.737373114 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:39.058825016 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:39.061162949 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:39.181359053 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:39.502671003 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:39.502868891 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:39.790678978 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:40.061496973 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:40.113018036 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:40.113069057 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:40.174000025 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:40.188647032 CET	587	49955	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:40.188694000 CET	49955	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:40.315548897 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:40.322252989 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:41.871741056 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:41.871886015 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:41.991858006 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:42.325591087 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:42.326085091 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:42.446456909 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:42.776951075 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:42.777381897 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:42.915041924 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:43.247386932 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:43.247488976 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:43.247504950 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:43.247581959 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:43.247960091 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:43.254265070 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:43.263503075 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:43.405564070 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:43.742429018 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:43.744859934 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:43.864895105 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:44.195384026 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:44.195585012 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:44.322273016 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:44.634262085 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:44.653594971 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:44.654256105 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:44.754545927 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:44.774775982 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.083395004 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.083411932 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.083533049 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:45.086251974 CET	49932	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:45.086452961 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:45.128042936 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.130301952 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:45.213069916 CET	587	49932	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.214251995 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.216387033 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:45.257260084 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.606338024 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:45.606704950 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:45.732851028 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.172416925 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.172657967 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.309000969 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.639203072 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.639658928 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.639658928 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.639717102 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.639717102 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.643239975 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.808727026 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.808815002 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.808826923 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.808839083 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.808851004 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.808876991 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.808974028 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.809058905 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.811886072 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.811908960 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.811935902 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.812002897 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.817749977 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.817792892 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.818164110 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.825968027 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.826001883 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.826116085 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.875844002 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.875931025 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.884608030 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.884783983 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.935584068 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.935597897 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.935617924 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.935678005 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.935775995 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.938994884 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.940346956 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.946275949 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.946331024 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.953298092 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.953649998 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:46.994261026 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:46.994488955 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.006504059 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.006611109 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.055448055 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.055602074 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.055619955 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.055727959 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.055794954 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.058089972 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.058195114 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.073390961 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.076776028 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.113496065 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.117187977 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.126713991 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.176302910 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.176342010 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.176423073 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.178726912 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.181529045 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.186873913 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.186954975 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.193236113 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.246810913 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.289561033 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.296154022 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.296164989 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.296180964 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.296190977 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.296252012 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.296268940 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.298604012 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.298614025 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.301619053 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.301630020 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.301655054 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.306760073 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.306792974 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.313348055 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.313458920 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.366872072 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.366887093 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.416229963 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.416255951 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.416287899 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.416296959 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.416666031 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.416708946 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.417176008 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.519277096 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.519428968 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:47.644814968 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:47.977327108 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.019529104 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:48.139652967 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.143440008 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.231030941 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:48.473556042 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.473613024 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.473627090 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.473696947 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:48.474091053 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.474188089 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:48.478262901 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:48.601794958 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.953824997 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:48.957654953 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:49.081749916 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:49.414096117 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:49.414334059 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:49.540103912 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:49.872546911 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:49.872780085 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:49.992971897 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:50.367408991 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:50.367671013 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:50.494502068 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:50.844746113 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:50.848285913 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:50.968830109 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.399446964 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.401434898 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.523363113 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.855741978 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.856587887 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.856709003 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.856709003 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.856709003 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.858648062 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.977116108 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.977185965 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.977195978 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.977205992 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.977221012 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.977262020 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.978988886 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979002953 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979033947 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979083061 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979111910 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.979111910 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.979232073 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979276896 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979307890 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.979440928 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979473114 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979480982 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.979513884 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:51.979537964 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:51.979707956 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.098531961 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.098648071 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.098678112 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.098777056 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.100539923 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.100584030 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.100605011 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.100625038 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.100650072 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.100665092 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.100716114 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.100734949 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.100758076 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.100771904 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.122462034 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.122519970 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.153928995 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.153989077 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.218411922 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.218512058 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.218743086 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.218856096 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.221231937 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.221277952 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.221535921 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.221585035 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:17:52.242439985 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.273952007 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.342020988 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.342384100 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.344368935 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.344892979 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.368607044 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.368654013 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.400805950 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.400826931 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.466950893 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.466964960 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.467509031 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.467668056 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.469441891 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.469505072 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.469531059 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.469542980 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.469652891 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.469738007 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.469952106 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.470088005 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.470098972 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.490127087 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.490140915 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.490168095 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.520957947 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:52.520972967 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:53.292356014 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:17:53.414268017 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:03.277872086 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:03.400173903 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:03.730665922 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:03.730957031 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:03.731025934 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:03.731075048 CET	49966	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:03.732188940 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:03.851074934 CET	587	49966	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:03.852061033 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:03.852123022 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:05.199739933 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:05.200962067 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:05.327867985 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:05.660665989 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:05.661135912 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:05.783957005 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:06.116849899 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:06.117261887 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:06.353837967 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:06.690108061 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:06.690387964 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:06.690401077 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:06.690409899 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:06.690522909 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:06.690522909 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:06.693423033 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:06.818217993 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:07.151163101 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:07.158323050 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:07.279206038 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:07.618433952 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:07.619362116 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:07.746217012 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:08.081053972 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:08.081640005 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:08.208488941 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:08.562263012 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:08.562634945 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:08.687550068 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:09.090801954 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:09.094491005 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:09.214782953 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:09.672935963 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:09.673240900 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:09.803826094 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.136980057 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.137411118 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.137577057 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.137593985 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.137690067 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.139271975 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.263323069 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.263356924 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.263366938 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.263370991 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.263379097 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.263468981 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.265125036 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.265170097 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.265229940 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.265239000 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.265268087 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.265291929 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.280028105 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.280069113 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.280113935 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.280147076 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.327930927 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.327981949 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.390163898 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.390274048 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.390285015 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.390307903 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.390381098 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.390381098 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.392139912 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.392215967 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.392249107 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.394391060 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.406594038 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.409142017 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.449728012 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.450428009 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.511218071 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.511358976 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.513433933 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.513482094 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.513603926 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.514223099 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.514317036 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.526599884 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.528439045 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.631195068 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.631439924 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.631452084 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.631593943 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:10.632864952 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.632998943 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.646471977 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.754739046 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.754754066 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.756262064 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.756503105 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.771518946 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.772214890 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.880285978 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.880304098 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.880312920 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.880331993 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.880341053 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.880350113 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.881956100 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.882097960 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.882107019 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.882116079 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.882209063 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.897471905 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:10.897504091 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.003324986 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.003449917 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.003458977 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.003468990 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.003489017 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.003654003 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.004934072 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.005057096 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.005094051 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.875576973 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:11.934191942 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:12.846318960 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:12.969695091 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:13.311348915 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:13.312562943 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:13.312618971 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:13.312720060 CET	49976	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:13.314322948 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:13.439054012 CET	587	49976	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:13.440606117 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:13.440701962 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:14.747334003 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:14.747544050 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:14.867794037 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:15.195033073 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:15.195240021 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:15.322184086 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:15.650046110 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:15.650501966 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:15.773336887 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:16.103722095 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:16.103760004 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:16.103773117 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:16.103848934 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:16.104367018 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:16.104422092 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:16.105794907 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:16.232729912 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:16.560205936 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:16.614347935 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:16.739712000 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:17.066914082 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:17.067183971 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:17.187489033 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:17.514681101 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:17.515007019 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:17.642187119 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:17.986381054 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:17.987528086 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:18.002614021 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.002944946 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:18.107836962 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.108874083 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.108958006 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:18.126586914 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.451807022 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.452172995 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.454410076 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:18.454524994 CET	50016	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:18.462630987 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.472410917 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:18.574512005 CET	587	50016	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:18.592514038 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.011384964 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.014014006 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.137906075 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.467148066 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.472358942 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.473581076 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.482386112 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.482505083 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.482505083 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.482505083 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.484040022 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.593772888 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.602597952 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.602633953 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.602643013 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.602653027 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.602684021 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.602796078 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.604219913 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.604243040 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.604286909 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.604340076 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.604485035 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.604502916 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.604545116 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.604605913 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.604651928 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.604681015 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.604743004 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.713790894 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.713838100 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.713893890 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.722589016 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.722659111 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.722726107 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.722804070 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.722815037 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.722860098 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.724359989 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.724422932 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.724452972 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.724514008 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.724605083 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.724627972 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.724692106 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.724693060 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.765798092 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.765863895 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.836220026 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.836297989 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.845541954 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.845618963 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.846913099 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.846981049 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.847001076 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.847033024 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.847052097 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.847081900 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.847127914 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.847177982 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.847179890 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.847232103 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.847249985 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.847270966 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.943002939 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.943145990 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:19.957896948 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.967853069 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.967994928 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.969217062 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.969271898 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.969392061 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.969429970 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.969574928 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:19.969583988 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.084382057 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.084394932 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.084404945 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.094682932 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.094693899 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.094801903 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.094882965 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096079111 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096110106 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096350908 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096359968 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096468925 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096492052 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096641064 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096657038 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096770048 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096880913 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.096889019 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.255074978 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.255089045 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.255203962 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.255219936 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.255273104 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.255281925 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.601798058 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:20.604795933 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:20.730823994 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.076575041 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.076757908 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.076771975 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.076865911 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:21.077303886 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.078617096 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:21.080383062 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:21.132114887 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.185358047 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:21.204001904 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.545299053 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:21.547729015 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:21.667853117 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:22.013031960 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:22.013449907 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:22.140919924 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:22.484379053 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:22.489442110 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:22.616657019 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:22.980046034 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:22.980581045 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:23.100745916 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:23.452091932 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:23.452285051 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:23.576987028 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.017611980 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.017812014 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.144898891 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.488406897 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.494754076 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.494755030 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.494860888 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.494860888 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.498425961 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.615205050 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.615217924 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.615228891 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.615238905 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.615547895 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.618720055 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.618738890 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.618823051 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.618834019 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.618879080 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.618879080 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.618913889 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.619009018 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.619019032 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.619050980 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.619137049 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.734829903 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.734855890 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.734978914 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.735657930 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.735856056 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.735954046 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.739037037 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.739147902 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.739159107 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.739281893 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.739325047 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.739447117 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.739455938 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.739478111 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.739548922 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.855278969 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.856153965 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.856515884 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.859189034 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.859272957 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.859352112 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.859358072 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.859488964 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.859503984 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:24.859797955 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.859880924 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.901771069 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.981307030 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.982233047 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.985486031 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.985531092 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.985713959 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.985752106 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:24.986007929 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.027875900 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.027894974 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.106062889 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.106076956 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.106964111 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.106996059 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.109992981 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110007048 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110054970 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110100985 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110299110 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110418081 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110433102 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110505104 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110605955 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110666037 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110761881 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110815048 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.110922098 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.736193895 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:25.934293032 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:33.989485979 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:34.116061926 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:34.443197012 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:34.446738958 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:34.448050022 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:34.499923944 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:34.502456903 CET	50026	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:34.573601007 CET	587	50026	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:34.574969053 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:34.578484058 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:35.948221922 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:35.948364019 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:36.075432062 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:36.427022934 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:36.434393883 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:36.561736107 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:36.912491083 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:36.914927959 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:37.034987926 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:37.387687922 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:37.387713909 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:37.387726068 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:37.387962103 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:37.388190985 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:37.389771938 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:37.389771938 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:37.516807079 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:37.868546009 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:37.870425940 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:37.994894981 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:38.346395969 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:38.346673012 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:38.380270958 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:38.468488932 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:38.501003027 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:38.501302958 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:38.819274902 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:38.820142984 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:38.940325022 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:39.311479092 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:39.311919928 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:39.432005882 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:39.788672924 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:39.788938999 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:39.864389896 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:39.864540100 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:39.915608883 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:39.984577894 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.324963093 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.325102091 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.360153913 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.360342026 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.452229023 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.486051083 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.792325020 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.792804003 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.837251902 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.837788105 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.837788105 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.837788105 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.837913990 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.839380026 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.919934034 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.964797974 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.964813948 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.964824915 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.964941025 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.964987993 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.965886116 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.965913057 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.965950966 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.966051102 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.966061115 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.966079950 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.966187000 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.966195107 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:40.966218948 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:40.966387033 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.042943001 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.042964935 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.043246984 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.086494923 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.086565971 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.086604118 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.086694002 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.087393045 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.087655067 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.087807894 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.087970972 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.087980986 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.088016033 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.088145971 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.088155031 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.088195086 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.088404894 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.206495047 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.207812071 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.208004951 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.208352089 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.208432913 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.208570004 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.208580017 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.208606005 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.208688974 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.208699942 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.208728075 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.218405962 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.249943018 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.262315989 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.262417078 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.262429953 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.262448072 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.263219118 CET	587	50029	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.263252020 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.263324022 CET	50029	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.274394035 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.283860922 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328008890 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328211069 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328418970 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328547955 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328557968 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328648090 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328658104 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328696966 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.328706980 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.329154968 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.403603077 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.403616905 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.403636932 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448148966 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448163986 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448174953 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448184967 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448271990 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448282003 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448292017 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448311090 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448322058 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448332071 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448343039 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448662996 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448673964 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448683977 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448693037 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448723078 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.448734045 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.793250084 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.793638945 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.793701887 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.794250011 CET	50027	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.796504021 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:41.915905952 CET	587	50027	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.917895079 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:41.917963982 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:42.068450928 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:42.168705940 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:43.223130941 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:43.226536989 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:43.348135948 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:43.687553883 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:43.687733889 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:43.817050934 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:44.147063971 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:44.147532940 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:44.273228884 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:44.608400106 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:44.608488083 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:44.608501911 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:44.608588934 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:44.609097958 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:44.609271049 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:44.610733986 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:44.732625008 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:45.065625906 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:45.070482016 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:45.197419882 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:45.530322075 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:45.530569077 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:45.890919924 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:45.890980005 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:45.934303999 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:46.132592916 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:46.132612944 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:46.465075970 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:46.466643095 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:46.593816042 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:46.948358059 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:46.948626041 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:47.068876982 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:47.417712927 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:47.418086052 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:47.539000034 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:47.980895042 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:47.981082916 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.106090069 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.448839903 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.449296951 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.449296951 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.449352980 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.449418068 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.450686932 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.576312065 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.576329947 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.576338053 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.576344013 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.577511072 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.577533007 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.577630043 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.577657938 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.578330994 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.578361988 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.581398964 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.702399969 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.702418089 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.703605890 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.703615904 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.703624964 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.703655958 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.703798056 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.703807116 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.703821898 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.703841925 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.705873966 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.822474003 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.823019028 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.823295116 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.823486090 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.823604107 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.825517893 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.865982056 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.868674994 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.943387985 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.945512056 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:48.946038961 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:48.946275949 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:49.065198898 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.065330029 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:18:49.065680027 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.065994024 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.068886995 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.191732883 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.192084074 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.192359924 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.195172071 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.195354939 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.318639040 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.318655968 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.320446968 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.320456982 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.320465088 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.321827888 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.321835995 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.321842909 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.321852922 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.439445019 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.439457893 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.439466953 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.440431118 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.442035913 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.442044973 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.442317963 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.442327976 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.442336082 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.442344904 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.446412086 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.559907913 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.559921026 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.559931040 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.560456991 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:49.560466051 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:50.452188969 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:18:50.622435093 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:03.398997068 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:03.525326014 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:03.875926971 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:03.875953913 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:03.876008987 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:03.877124071 CET	50028	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:03.879131079 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:04.003894091 CET	587	50028	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:04.005822897 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:04.005897999 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:05.344616890 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:05.350455046 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:05.474808931 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:05.806034088 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:05.806389093 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:05.927953005 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:06.259654045 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:06.260133982 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:06.386821985 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:06.720278025 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:06.720340967 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:06.720371962 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:06.720530033 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:06.720938921 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:06.722533941 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:06.726455927 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:06.851115942 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:07.182748079 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:07.184864998 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:07.305041075 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:07.637275934 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:07.637625933 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:07.759253979 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:08.090465069 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:08.133116007 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:08.260381937 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:08.612613916 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:08.612865925 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:08.737216949 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:09.087346077 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:09.087970972 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:09.213757038 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:09.654591084 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:09.654789925 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:09.780484915 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.112588882 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.112924099 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.113027096 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.113027096 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.113101006 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.114379883 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.282727957 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.282758951 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.282768011 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.282778025 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.282788038 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.282815933 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.282937050 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.283072948 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.283108950 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.283144951 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.283184052 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.283193111 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.283200979 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.283246040 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.283293962 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.404041052 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.404123068 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.485650063 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.485666037 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.485677004 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.485708952 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.485774040 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.487040043 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.487101078 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.523809910 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.523880005 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.523972988 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.523996115 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.524071932 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.607665062 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.610649109 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.644999981 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.645066023 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.645145893 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.645253897 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.729971886 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.730153084 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.769557953 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.769753933 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:10.859925985 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:10.893362045 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.014195919 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.018166065 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.107430935 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.107449055 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138509035 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138535976 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138645887 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138667107 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138689995 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138729095 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138870955 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138880014 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.138911009 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.226142883 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.226160049 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.265085936 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.265176058 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.265194893 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.265290022 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.265333891 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:11.265368938 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:12.137042046 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:12.273952007 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:12.752585888 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:12.872944117 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:13.205220938 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:13.205693960 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:13.206156015 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:13.206156015 CET	50031	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:13.210472107 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:13.326617002 CET	587	50031	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:13.330528975 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:13.331252098 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:14.631259918 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:14.634655952 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:14.758598089 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.086268902 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.086508989 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:15.206619024 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.534303904 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.534761906 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:15.658253908 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.987226009 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.987360001 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.987371922 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.987401962 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:15.987952948 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:15.988003016 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:15.990238905 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:16.113663912 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:16.441471100 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:16.443736076 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:16.568095922 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:16.895880938 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:16.896677017 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:17.016736984 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:17.345501900 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:17.482490063 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.299854040 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.419815063 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:20.752299070 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:20.752720118 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:20.752785921 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.752856970 CET	50030	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.753331900 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.879435062 CET	587	50030	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:20.880100965 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:20.880188942 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.909401894 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.909702063 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:20.955475092 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:21.029392004 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:21.030047894 CET	587	50032	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:21.030102968 CET	50032	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:21.075433969 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:21.075508118 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:22.184061050 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:22.184243917 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:22.311264038 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:22.644680023 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:22.644833088 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:22.764833927 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:22.949794054 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:22.950483084 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:23.070367098 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.098561049 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.099129915 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:23.219327927 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.395632029 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.395801067 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:23.518955946 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.554377079 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.554477930 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.554491043 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.554534912 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:23.554943085 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.555003881 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:23.557051897 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:23.677448034 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.843940020 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:23.844307899 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:23.969481945 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.011245966 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.013542891 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:24.140857935 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.296570063 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.296674013 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.296686888 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.296756983 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:24.297269106 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.297327995 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:24.298832893 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:24.474906921 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.475109100 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:24.487601995 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.595253944 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.812782049 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.814100981 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:24.929292917 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:24.929579973 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:24.934314013 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.049875021 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.273689985 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.273937941 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:25.394212008 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.432915926 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.433245897 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:25.553504944 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.719516993 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.719815969 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:25.839941025 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.899486065 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:25.899785995 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.022823095 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.187005043 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.187282085 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.307570934 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.363445044 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.363615036 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.489648104 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.638323069 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.638783932 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.765636921 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.823235989 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:26.823612928 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.823666096 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.823683023 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.823744059 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:26.826574087 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.063919067 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.063935995 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.063945055 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.063982964 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.063992023 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.063996077 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.064001083 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.063999891 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.064065933 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.064081907 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.064116955 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.067713022 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.067723989 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.067768097 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.184046984 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.184129000 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.184134960 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.184345961 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.187817097 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.187841892 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.187881947 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.187906981 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.187907934 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.187943935 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.187951088 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.187995911 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.305675030 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.305740118 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.309710979 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.309772968 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.309783936 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.309830904 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.354197979 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.354296923 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.432519913 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.432548046 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.432612896 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.478849888 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.478945017 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.496936083 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.522201061 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.522248030 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.559216022 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.559237003 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.559322119 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.648791075 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.648807049 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.648905993 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.685313940 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.685399055 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.685410023 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.685461998 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.685467005 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.685508966 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.805372000 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.805455923 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.884259939 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.884694099 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.884694099 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.884799957 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.885020018 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.886113882 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:27.925889015 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:27.926107883 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046001911 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046036005 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046075106 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046086073 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046184063 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046195030 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046205997 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.046283007 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168493986 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168555021 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168591022 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168620110 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168648958 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168718100 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168768883 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168797970 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168832064 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.168879986 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.200130939 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.230212927 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.230361938 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.295260906 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.295275927 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.295500994 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.295543909 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.295752048 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.295793056 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.295902967 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.295991898 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.296008110 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.296031952 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.296156883 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.456401110 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456418991 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456492901 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456512928 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456554890 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.456604004 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456613064 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.456645966 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456727028 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456775904 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.456779957 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456882954 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456902981 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456958055 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.456970930 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.456970930 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.458704948 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.577090979 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.577195883 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.577197075 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.577318907 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.697495937 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.697616100 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.697763920 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.698542118 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.821310043 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.821398020 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.821517944 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.821573019 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.821592093 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.821650982 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.821806908 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.821876049 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.862776995 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.862854958 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.951076984 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:28.951163054 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.951277971 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:28.951354980 CET	50034	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:29.063149929 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.075735092 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.075875998 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.106318951 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:29.195816040 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.195858955 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.195894957 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.195924044 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.195966005 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.195993900 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.196021080 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.196048975 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.196075916 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.196109056 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.196135998 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.315777063 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.315792084 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.315809011 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.315818071 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.315859079 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.315869093 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.315934896 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.316016912 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.316025972 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.316061974 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.316097975 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.410415888 CET	587	50033	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.410487890 CET	50033	587	192.168.2.4	77.88.21.158
Nov 27, 2024 19:19:29.435653925 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.435702085 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.435735941 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.435805082 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.435832977 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:29.435863972 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:30.274667025 CET	587	50034	77.88.21.158	192.168.2.4
Nov 27, 2024 19:19:30.326585054 CET	50034	587	192.168.2.4	77.88.21.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 19:15:14.775259018 CET	61512	53	192.168.2.4	1.1.1.1
Nov 27, 2024 19:15:14.952023029 CET	53	61512	1.1.1.1	192.168.2.4
Nov 27, 2024 19:15:17.442326069 CET	49832	53	192.168.2.4	1.1.1.1
Nov 27, 2024 19:15:18.310247898 CET	53	49832	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 27, 2024 19:15:14.775259018 CET	192.168.2.4	1.1.1.1	0xb321	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 27, 2024 19:15:17.442326069 CET	192.168.2.4	1.1.1.1	0xacae	Standard query (0)	smtp.yandex.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 19:15:14.952023029 CET	1.1.1.1	192.168.2.4	0xb321	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 27, 2024 19:15:14.952023029 CET	1.1.1.1	192.168.2.4	0xb321	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 27, 2024 19:15:14.952023029 CET	1.1.1.1	192.168.2.4	0xb321	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 27, 2024 19:15:18.310247898 CET	1.1.1.1	192.168.2.4	0xacae	No error (0)	smtp.yandex.com	smtp.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 19:15:18.310247898 CET	1.1.1.1	192.168.2.4	0xacae	No error (0)	smtp.yandex.ru		77.88.21.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.26.12.205	443	2032	C:\Users\user\Desktop\DHL Delivery Invoice.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 18:15:16 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-27 18:15:16 UTC	424	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 18:15:16 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e941a48caeb0fa1-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1492&min_rtt=1487&rtt_var=569&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1903520&cwnd=252&unsent_bytes=0&cid=30fdcb6e3cc14057&ts=522&x=0"
2024-11-27 18:15:16 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.26.12.205	443	7436	C:\Users\user\AppData\Roaming\LIWBHGsz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 18:15:20 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-27 18:15:21 UTC	424	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 18:15:21 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e941a6508730cb2-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1564&min_rtt=1560&rtt_var=588&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1871794&cwnd=146&unsent_bytes=0&cid=21241de9939ceb74&ts=533&x=0"
2024-11-27 18:15:21 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 27, 2024 19:15:19.784538984 CET	587	49735	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net Ok 1732731319-JFea5f0OeSw0
Nov 27, 2024 19:15:19.788817883 CET	49735	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:15:20.241609097 CET	587	49735	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:15:20.241791964 CET	49735	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:15:20.700320005 CET	587	49735	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:15:23.552289963 CET	587	49738	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.klg.yp-c.yandex.net Ok 1732731323-MFem4i0OjmI0
Nov 27, 2024 19:15:23.554558992 CET	49738	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:15:24.041109085 CET	587	49738	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:15:24.041301966 CET	49738	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:15:24.642561913 CET	587	49738	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:16:35.989707947 CET	587	49820	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net Ok 1732731395-ZGeSll0OkKo0
Nov 27, 2024 19:16:35.989877939 CET	49820	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:16:36.458970070 CET	587	49820	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:16:36.460949898 CET	49820	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:16:36.917356968 CET	587	49820	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:16:54.006361008 CET	587	49857	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net Ok 1732731413-rGePZf0OqmI0
Nov 27, 2024 19:16:54.007723093 CET	49857	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:16:54.572233915 CET	587	49857	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-23.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:16:54.572470903 CET	49857	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:16:55.084091902 CET	587	49857	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:05.782105923 CET	587	49882	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-54.vla.yp-c.yandex.net Ok 1732731425-5HeJIo0OeW20
Nov 27, 2024 19:17:05.782222986 CET	49882	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:06.368886948 CET	587	49882	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-54.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:06.371643066 CET	49882	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:06.877026081 CET	587	49882	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:09.569925070 CET	587	49891	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net Ok 1732731429-9HeGUr0OnGk0
Nov 27, 2024 19:17:09.573782921 CET	49891	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:10.028413057 CET	587	49891	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:10.028656960 CET	49891	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:10.544131994 CET	587	49891	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:25.494473934 CET	587	49923	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-91.myt.yp-c.yandex.net Ok 1732731445-PHeuVX0Ol4Y0
Nov 27, 2024 19:17:25.494637966 CET	49923	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:26.031265020 CET	587	49923	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-91.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:26.031404018 CET	49923	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:26.490036964 CET	587	49923	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:28.007865906 CET	587	49929	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-84.vla.yp-c.yandex.net Ok 1732731447-RHeCbe0OgmI0
Nov 27, 2024 19:17:28.008336067 CET	49929	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:28.477503061 CET	587	49929	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-84.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:28.478343010 CET	49929	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:28.545458078 CET	587	49932	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net Ok 1732731448-SHeJbr0OniE0
Nov 27, 2024 19:17:28.546442986 CET	49932	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:28.979640961 CET	587	49929	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:29.008690119 CET	587	49932	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:29.010523081 CET	49932	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:29.459299088 CET	587	49932	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:32.368561029 CET	587	49942	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-45.klg.yp-c.yandex.net Ok 1732731452-VHea1h0OdqM0
Nov 27, 2024 19:17:32.370347023 CET	49942	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:32.832662106 CET	587	49942	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-45.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:32.833506107 CET	49942	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:33.292459965 CET	587	49942	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:35.433774948 CET	587	49949	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-51.vla.yp-c.yandex.net Ok 1732731455-ZHenFr0OruQ0
Nov 27, 2024 19:17:35.433888912 CET	49949	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:37.101612091 CET	587	49955	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net Ok 1732731456-aHeRKa0OcGk0
Nov 27, 2024 19:17:37.102360964 CET	49955	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:37.561805010 CET	587	49955	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:37.561934948 CET	49955	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:38.003779888 CET	587	49955	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:41.871741056 CET	587	49966	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net Ok 1732731461-fHe12c0On4Y0
Nov 27, 2024 19:17:41.871886015 CET	49966	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:42.325591087 CET	587	49966	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:42.326085091 CET	49966	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:42.776951075 CET	587	49966	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:17:46.994261026 CET	587	49976	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-13.klg.yp-c.yandex.net Ok 1732731466-kHeV3p0OdeA0
Nov 27, 2024 19:17:46.994488955 CET	49976	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:17:47.519277096 CET	587	49976	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-13.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:17:47.519428968 CET	49976	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:17:47.977327108 CET	587	49976	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:18:05.199739933 CET	587	50016	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.vla.yp-c.yandex.net Ok 1732731484-4IeMvt0Op4Y0
Nov 27, 2024 19:18:05.200962067 CET	50016	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:18:05.660665989 CET	587	50016	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:18:05.661135912 CET	50016	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:18:06.116849899 CET	587	50016	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:18:14.747334003 CET	587	50026	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-81.vla.yp-c.yandex.net Ok 1732731494-EIegcg0OqeA0
Nov 27, 2024 19:18:14.747544050 CET	50026	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:18:15.195033073 CET	587	50026	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-81.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:18:15.195240021 CET	50026	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:18:15.650046110 CET	587	50026	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:18:19.472358942 CET	587	50027	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net Ok 1732731499-JIeJur0Om8c0
Nov 27, 2024 19:18:19.473581076 CET	50027	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:18:19.943002939 CET	587	50027	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:18:19.943145990 CET	50027	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:18:20.601798058 CET	587	50027	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:18:35.948221922 CET	587	50028	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net Ok 1732731515-ZIemYm0Or0U0
Nov 27, 2024 19:18:35.948364019 CET	50028	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:18:36.427022934 CET	587	50028	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:18:36.434393883 CET	50028	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:18:36.912491083 CET	587	50028	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:18:39.864389896 CET	587	50029	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-19.klg.yp-c.yandex.net Ok 1732731519-dIeAtn0OfOs0
Nov 27, 2024 19:18:39.864540100 CET	50029	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:18:40.324963093 CET	587	50029	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-19.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:18:40.325102091 CET	50029	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:18:40.792325020 CET	587	50029	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:18:43.223130941 CET	587	50030	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-22.iva.yp-c.yandex.net Ok 1732731522-gIeHVZ0OiGk0
Nov 27, 2024 19:18:43.226536989 CET	50030	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:18:43.687553883 CET	587	50030	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-22.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:18:43.687733889 CET	50030	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:18:44.147063971 CET	587	50030	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:19:05.344616890 CET	587	50031	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-38.myt.yp-c.yandex.net Ok 1732731545-4JeFqd0OlKo0
Nov 27, 2024 19:19:05.350455046 CET	50031	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:19:05.806034088 CET	587	50031	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-38.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:19:05.806389093 CET	50031	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:19:06.259654045 CET	587	50031	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:19:14.631259918 CET	587	50032	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-69.iva.yp-c.yandex.net Ok 1732731554-EJejLW0OrGk0
Nov 27, 2024 19:19:14.634655952 CET	50032	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:19:15.086268902 CET	587	50032	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-69.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:19:15.086508989 CET	50032	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:19:15.534303904 CET	587	50032	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:19:22.184061050 CET	587	50033	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-13.klg.yp-c.yandex.net Ok 1732731561-LJeMep0OdOs0
Nov 27, 2024 19:19:22.184243917 CET	50033	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:19:22.644680023 CET	587	50033	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-13.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:19:22.644833088 CET	50033	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:19:22.949794054 CET	587	50034	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-25.sas.yp-c.yandex.net Ok 1732731562-MJeM5p0MnmI0
Nov 27, 2024 19:19:22.950483084 CET	50034	587	192.168.2.4	77.88.21.158	EHLO 928100
Nov 27, 2024 19:19:23.098561049 CET	587	50033	77.88.21.158	192.168.2.4	220 Go ahead
Nov 27, 2024 19:19:23.395632029 CET	587	50034	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-25.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 27, 2024 19:19:23.395801067 CET	50034	587	192.168.2.4	77.88.21.158	STARTTLS
Nov 27, 2024 19:19:23.843940020 CET	587	50034	77.88.21.158	192.168.2.4	220 Go ahead

Target ID:	0
Start time:	13:15:10
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\DHL Delivery Invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Imagebase:	0x6a0000
File size:	1'000'448 bytes
MD5 hash:	9AF85D4623CAFA79192F542727A6E923
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1843513866.00000000079A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1828601395.0000000004318000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1828601395.0000000004355000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:15:12
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Imagebase:	0xb70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:15:12
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:15:13
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LIWBHGsz.exe"
Imagebase:	0xb70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:15:13
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:15:13
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpC314.tmp"
Imagebase:	0x8b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:15:13
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:15:13
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\DHL Delivery Invoice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Imagebase:	0x300000
File size:	1'000'448 bytes
MD5 hash:	9AF85D4623CAFA79192F542727A6E923
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:15:13
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\DHL Delivery Invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL Delivery Invoice.exe"
Imagebase:	0x470000
File size:	1'000'448 bytes
MD5 hash:	9AF85D4623CAFA79192F542727A6E923
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.4259345206.0000000002811000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:15:13
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Roaming\LIWBHGsz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\LIWBHGsz.exe
Imagebase:	0xc40000
File size:	1'000'448 bytes
MD5 hash:	9AF85D4623CAFA79192F542727A6E923
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1880257030.0000000004908000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1880257030.0000000004B6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:15:16
Start date:	27/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:15:18
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LIWBHGsz" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp"
Imagebase:	0x8b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:15:18
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:15:18
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Roaming\LIWBHGsz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\LIWBHGsz.exe"
Imagebase:	0xd40000
File size:	1'000'448 bytes
MD5 hash:	9AF85D4623CAFA79192F542727A6E923
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.4254539671.0000000000437000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.4259229208.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	175
Total number of Limit Nodes:	10

Executed Functions

Function 097E2E58 Relevance: 8.5, Strings: 6, Instructions: 1022
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 097E3A49
xbnq, xrefs: 097E2F88
poq, xrefs: 097E3B21
Tekq, xrefs: 097E36AC
TJpq, xrefs: 097E2FFD
<ov!, xrefs: 097E3254

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: 4'kq$<ov!$TJpq$Tekq$poq$xbnq
API String ID: 0-2107662943
Opcode ID: 20feae5ed2dc369b9ffbc5776b2577cf90dbe61c19be2ffaf92612381002a28e
Instruction ID: 0faeb2643e5e5d102afe9404b279bae9bbbd0b358f7f4c6c49bae60d33e843b7
Opcode Fuzzy Hash: 20feae5ed2dc369b9ffbc5776b2577cf90dbe61c19be2ffaf92612381002a28e
Instruction Fuzzy Hash: F4B2C675E00628CFDB54CF69C984AD9BBB2FF89304F1581E9E509AB265DB319E81CF40

Function 097157DC Relevance: 6.9, Strings: 5, Instructions: 624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 09717C8C
Hoq, xrefs: 09717E5B
Hoq, xrefs: 09717BF9
Hoq, xrefs: 09717D13
Hoq, xrefs: 09717D9D

Memory Dump Source

Source File: 00000000.00000002.1849611989.0000000009710000.00000040.00000800.00020000.00000000.sdmp, Offset: 09710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9710000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: Hoq$Hoq$Hoq$Hoq$Hoq
API String ID: 0-1079488684
Opcode ID: 65940b33a8f9fc26132a8011ff711a269caa5acd12c72229d956fbe6c81aaab7
Instruction ID: 35cabf3e94bb2f533999a0f0161379849c83716c61894009f86b6fb3afd93db4
Opcode Fuzzy Hash: 65940b33a8f9fc26132a8011ff711a269caa5acd12c72229d956fbe6c81aaab7
Instruction Fuzzy Hash: 01326D71E002588FDB58DF7CC8517AEBBF6AF84300F14856AD40AAB395DB349D45CBA1

Function 097E2E4C Relevance: 4.0, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xbnq, xrefs: 097E2F88
Tekq, xrefs: 097E36AC
TJpq, xrefs: 097E2FFD

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: TJpq$Tekq$xbnq
API String ID: 0-3321955333
Opcode ID: ecf6f9a86f088d01e56fe89d94c8c3f01754047c65f3dd2ecada82211d8293b6
Instruction ID: ac120925afed040bdfebfe496e3e022f63b7f6d12d184d0ecae96e0b7ced1e46
Opcode Fuzzy Hash: ecf6f9a86f088d01e56fe89d94c8c3f01754047c65f3dd2ecada82211d8293b6
Instruction Fuzzy Hash: 13B17375E006288FDB58CF6AC944ADDBBF2BF88301F14C0A9D909AB365DB345A858F50

Function 02AA132F Relevance: 2.8, Strings: 2, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tekq, xrefs: 02AA1471
Tekq, xrefs: 02AA164D

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: Tekq$Tekq
API String ID: 0-2269808460
Opcode ID: a0b0ac645e33f9ebf6485bed2eaf6db2c3d5100b9af382fc39b236a407c87769
Instruction ID: 79a193afcbddc0f13acf1b9e4640d99003d44f48f16bb6fcd81f819f1d346a41
Opcode Fuzzy Hash: a0b0ac645e33f9ebf6485bed2eaf6db2c3d5100b9af382fc39b236a407c87769
Instruction Fuzzy Hash: 3EB16974E042499FDB04CFA9C8546EEFFF2BF8A310F14846AD855AB265DB349906CF24

Function 02AA1363 Relevance: 2.8, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tekq, xrefs: 02AA1471
Tekq, xrefs: 02AA164D

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: Tekq$Tekq
API String ID: 0-2269808460
Opcode ID: f0c42bbdfacad30e3a047afe64857201480d579cfe78df3539d66bfd803cbcfc
Instruction ID: 07b4212add976d3d0b7670302b2a41fdfec3a9f99b88598d60e1309b6a0f96f9
Opcode Fuzzy Hash: f0c42bbdfacad30e3a047afe64857201480d579cfe78df3539d66bfd803cbcfc
Instruction Fuzzy Hash: ACB17A74E042499FDB04CFE9C8546EEFFF2AF8A300F18846AD855AB255DB349906CF24

Function 02AA1408 Relevance: 2.7, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tekq, xrefs: 02AA1471
Tekq, xrefs: 02AA164D

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: Tekq$Tekq
API String ID: 0-2269808460
Opcode ID: e531eac8d530b9453d350e9ed0f73bdafccbd76f2180f8f3437fa217ae117813
Instruction ID: fb5d558ee2e71abc70e6e054b0ad95691242fc8ab2b203fa1b9a75067402299b
Opcode Fuzzy Hash: e531eac8d530b9453d350e9ed0f73bdafccbd76f2180f8f3437fa217ae117813
Instruction Fuzzy Hash: 7391D6B4E012099FDB04CFA9C9906AEFBB2FF89300F14942AD519BB354D7355901CF64

Function 02AA3450 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4aafc4dc287c8091df21fae6e1f7be830e364ec25ded23b5bee381e4eaac95d
Instruction ID: c49e42808143d71994b34986200f4db551fa119084fdc116c34aadb71c6685d4
Opcode Fuzzy Hash: e4aafc4dc287c8091df21fae6e1f7be830e364ec25ded23b5bee381e4eaac95d
Instruction Fuzzy Hash: 9BF1D174D05246DFCB08CFA9C4958AEFFB2FF89300B549499C452AB215DB34EA86CF90

Function 09835AB0 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90894d5ae96a0711f2876f895329f816040a955800b8493d007b809d184c7eaa
Instruction ID: 74d9f44e1acfed3edb4f9a1e68b33e30712fc1d8d79b90fb6f71acf9c78894ae
Opcode Fuzzy Hash: 90894d5ae96a0711f2876f895329f816040a955800b8493d007b809d184c7eaa
Instruction Fuzzy Hash: 55C18C717016049FDB19EB7AC460BAAB7E6AF88704F54846DE14ACB390DB35E902CB91

Function 02AA3540 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2f9c61e2984025ac1eb13ca1503b99860e0565627c6bfa00ffadcdccc50bea
Instruction ID: d4a9a326668b3d8f64ae7f44885e5fc56bccf15909268b0fb86f6b9b015f2097
Opcode Fuzzy Hash: 0c2f9c61e2984025ac1eb13ca1503b99860e0565627c6bfa00ffadcdccc50bea
Instruction Fuzzy Hash: 40D10A74D0520ADFCB08CF9AD4948AEFBB2FF89300B549559D416AB314DB35E982CFA4

Function 097157D5 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849611989.0000000009710000.00000040.00000800.00020000.00000000.sdmp, Offset: 09710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9710000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41e0ec95f290e9e2e6058ca8957aabe570de777e7a3e6264b3e90086c9eba7d
Instruction ID: 2b5b16b97ad5e755d6c996f7dab64963bd8b815f93addb5c4ff49e535bded535
Opcode Fuzzy Hash: a41e0ec95f290e9e2e6058ca8957aabe570de777e7a3e6264b3e90086c9eba7d
Instruction Fuzzy Hash: C9C12972E00258CFCF19CFA9C88579DBBF2AF88310F14C5AAE449AB255DB30D995CB50

Function 09717628 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849611989.0000000009710000.00000040.00000800.00020000.00000000.sdmp, Offset: 09710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9710000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58eab030a765f92fa886e76f41431817752240a740430b7e5f21fb8ea90091bc
Instruction ID: 1f27fe2cbe8918096efc4616cd15d189b2de9d2b07e6d726275a58b2abf31d09
Opcode Fuzzy Hash: 58eab030a765f92fa886e76f41431817752240a740430b7e5f21fb8ea90091bc
Instruction Fuzzy Hash: 62C13972E00258CFCF19CFA9C885799BBF2AF88310F14C5AAE449AB255DB31D985CF50

Function 02AACA98 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3aa099d13dc32e9d9944442136c156cbab45cfdd334a7897f0ee4f3a549f63
Instruction ID: c79304c42d0c6ae1fa4d2e3ff07012dc55335615bb59cb9d3c5c6694ed7dbd3f
Opcode Fuzzy Hash: 1c3aa099d13dc32e9d9944442136c156cbab45cfdd334a7897f0ee4f3a549f63
Instruction Fuzzy Hash: CF7178B4E062089FDB04CFA9D8555EEBBB2FF89310F14806AD416E7364EB349A06CF51

Function 09833ADC Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ac0ecb86b33d6082fe57c8192c579dfae3c7b0d32beaa823652d790ac98858
Instruction ID: 3fcb072aec0e73ae7d3acaab9a1a6101447c9e5a18fa58b271240187cf86d0e0
Opcode Fuzzy Hash: 00ac0ecb86b33d6082fe57c8192c579dfae3c7b0d32beaa823652d790ac98858
Instruction Fuzzy Hash: 90611471E44229CBDB68CF66C8407E9FBB6BFC9300F54D1AAD409A7250EB744A85CF80

Function 02AA97E0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267c81c68ea1d56cdec76928b00ad2fad4e68ceb0fbfb3e8389601d36a28393b
Instruction ID: d992851ee8d388dbdda6d5bfb627fb518e38f39eefd1ed8bf53a69f48d2a25bd
Opcode Fuzzy Hash: 267c81c68ea1d56cdec76928b00ad2fad4e68ceb0fbfb3e8389601d36a28393b
Instruction Fuzzy Hash: 0061E2B4E01209DFDB08CFA9D9555AEBBB2FF88310F14942AD416B7364EB349A42CF51

Function 02AA1C98 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04a29a34e34ffe6de84d05dfb872b1ea4de14fd4ccc5f5a7ccf6ee87b102cab
Instruction ID: 2f7fcb43182813f04275c7a436326f0db2e51d487558963791050050c75946da
Opcode Fuzzy Hash: a04a29a34e34ffe6de84d05dfb872b1ea4de14fd4ccc5f5a7ccf6ee87b102cab
Instruction Fuzzy Hash: 09511B74E0520A9FCB08CFAAC5506AEFBF2EF89300F24D46AD419A7355DB345A41CF64

Function 097E92E8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89b30bfa018bf5f5b939484cf1cbebf9ad5a22b499174e10bd019ff356f9d03
Instruction ID: 52b1c724aa939428ee4ed4418eedac10ae3004a1c7ea25056d8d022fe8a85208
Opcode Fuzzy Hash: f89b30bfa018bf5f5b939484cf1cbebf9ad5a22b499174e10bd019ff356f9d03
Instruction Fuzzy Hash: AF415E72D052588FDB19CF6AC8407DEBBF7AF89300F04C1AAD509A62A5DB340A45CF51

Function 02AA2690 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cfab2a34111b24abc4e85938ed38d455033981b23c5ce1d87e6ca0f249a09f6
Instruction ID: 805864b8231fb97fca23f5d88bf08bd4d9604e02c5e6b012bc018b2ba0fe0512
Opcode Fuzzy Hash: 2cfab2a34111b24abc4e85938ed38d455033981b23c5ce1d87e6ca0f249a09f6
Instruction Fuzzy Hash: 3D314771E056088FDB18CFAAD8502DEBBB2AFC9300F14C0AAD409A7264DB340A56CF50

Function 09718368 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

epU, xrefs: 097183B4

Memory Dump Source

Source File: 00000000.00000002.1849611989.0000000009710000.00000040.00000800.00020000.00000000.sdmp, Offset: 09710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9710000_DHL Delivery Invoice.jbxd

Similarity

API ID: CreateFromIconResource
String ID: epU
API String ID: 3668623891-3012472399
Opcode ID: 3cdad4599a4e6b9fd044ad2277e6038cd7ac7bffff4e19ba188740a657c27aad
Instruction ID: c41e2fb419f8000af0a43dee59be863ff9390468d11c48efc631696afe29a338
Opcode Fuzzy Hash: 3cdad4599a4e6b9fd044ad2277e6038cd7ac7bffff4e19ba188740a657c27aad
Instruction Fuzzy Hash: FA3178729043999FCB11CFA9D844AEEBFF8EF09350F14809AF954AB221C7359950DFA1

Function 09830CC4 Relevance: 1.7, APIs: 1, Instructions: 246processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 09830F06

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1bac596ee664dd792bf71e08c1a30cafacaf4950ae442ece1fedbd3d45b54acc
Instruction ID: 3d61ccb061a99e203b86d6200f2815020014a2e40979530e10b61c1c044a2406
Opcode Fuzzy Hash: 1bac596ee664dd792bf71e08c1a30cafacaf4950ae442ece1fedbd3d45b54acc
Instruction Fuzzy Hash: 84A15971D00219DFDB10CFA8C941BDEBBB2AF48314F5485A9E848E7394DB749985CF91

Function 09830CD0 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 09830F06

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3022c1a9b3383c3cc3fb517cb5d388ed68638ccecf1a1b0972d301abb9d032b5
Instruction ID: fd31a5cd4b14ce814142c1a4906decf636846d22edd8b84adffd0415bfd2cf95
Opcode Fuzzy Hash: 3022c1a9b3383c3cc3fb517cb5d388ed68638ccecf1a1b0972d301abb9d032b5
Instruction Fuzzy Hash: 0F913571D00219DFDB20DFA8C941BEEBBB2AF48310F5485A9E848E7394DB749985CF91

Function 02AAB3F5 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02AAB4B1

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 51a26c3b8c1a6fcef8e16ba00b5509cd4706f318778fe61b48a7bd593857435b
Instruction ID: dc6f128b5cae04ba3d07c13ba1758d1797c867e003c36906771e107b6bd50f5a
Opcode Fuzzy Hash: 51a26c3b8c1a6fcef8e16ba00b5509cd4706f318778fe61b48a7bd593857435b
Instruction Fuzzy Hash: 9F41F1B0D00219CEDB24CFA9C8447DDBBF1BF49304F24816AD409AB265DB756946CFA1

Function 02AA9FBC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02AAB4B1

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3384e856b09c07ced31a118841855aec75b6487eb21ce8cadbf0974b84399946
Instruction ID: 5ad591b2f3eed1a393ea2e44396bed1d4ec20e1e5362fb778fab7784a3d494ea
Opcode Fuzzy Hash: 3384e856b09c07ced31a118841855aec75b6487eb21ce8cadbf0974b84399946
Instruction Fuzzy Hash: FE41FFB0C0061DDBDB24CFA9C844BCEBBF5BF48308F24846AD409AB255DBB56945CFA1

Function 09716CF9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 09716D97

Memory Dump Source

Source File: 00000000.00000002.1849611989.0000000009710000.00000040.00000800.00020000.00000000.sdmp, Offset: 09710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9710000_DHL Delivery Invoice.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 6e6e01653adf71837bcd8aed243679561204c656767e53847176c3bc5c921caa
Instruction ID: 250cefa68857d250b5c1fad66fd9842f8d003b172ea6d7c0ea0b94d339f41dcf
Opcode Fuzzy Hash: 6e6e01653adf71837bcd8aed243679561204c656767e53847176c3bc5c921caa
Instruction Fuzzy Hash: C931C4B5D012099FDF10CF99D884ADEBBF5FB58310F14842AE859A7210D774A545CFA0

Function 09830A40 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 09830AD8

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0a11ad198e6c01eec9f1dc544548f71ba4d78fc892ed1935c06b0d5f3cd63149
Instruction ID: 975d905f97592c01987efaa3011af0ca7f0018df3584f839b0e7d38105ea5446
Opcode Fuzzy Hash: 0a11ad198e6c01eec9f1dc544548f71ba4d78fc892ed1935c06b0d5f3cd63149
Instruction Fuzzy Hash: CC2146B5900359DFCB10CFA9D981BDEBBF5FF48320F10882AE558A7251C778A945CBA0

Function 09830A48 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 09830AD8

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8b0b5b0ecbd457d1cd3108259cc40c25363800d7e600e7ebb6e04bb2ee14250a
Instruction ID: 30931b3b2544fe63185f44bf2d95d6a3bcd2267a7881a0f0c0684916b25b66ff
Opcode Fuzzy Hash: 8b0b5b0ecbd457d1cd3108259cc40c25363800d7e600e7ebb6e04bb2ee14250a
Instruction Fuzzy Hash: 872127B1900359DFCB10CFA9C985BDEBBF5FF48320F108429E958A7250C778A944CBA4

Function 09716D00 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 09716D97

Memory Dump Source

Source File: 00000000.00000002.1849611989.0000000009710000.00000040.00000800.00020000.00000000.sdmp, Offset: 09710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9710000_DHL Delivery Invoice.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 95446dee606c4b56c3d655e1caba994aa45a3f11f0e822ef5ba0a1e09ee0c243
Instruction ID: 958a9edd9a8ab82cf95d9c44ee2fcbc164937e1dbaf42e4c4548879ffcac1496
Opcode Fuzzy Hash: 95446dee606c4b56c3d655e1caba994aa45a3f11f0e822ef5ba0a1e09ee0c243
Instruction Fuzzy Hash: 9021DFB6D002099FDB10CF9AD884ADEFBF4FB48320F14842AE959A7310D774A944CFA0

Function 09830B31 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 09830BB8

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cd7696571c501012d835ec6b893f16750a87d1dcfcf58f647911b7f16871a122
Instruction ID: 8eaaf21841deed130ed00b39c90c428e68c95fb17d28880b9156d7e23f2c03f0
Opcode Fuzzy Hash: cd7696571c501012d835ec6b893f16750a87d1dcfcf58f647911b7f16871a122
Instruction Fuzzy Hash: E32134B1801349DFCB10CFA9C980BEEBBF5FF48324F10882AE559A7250C7789945CBA0

Function 09830470 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 098304F6

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9db35c6cc3225dfe3c3b48e6993cb934fbf882369def35dca21c97ceffb762d1
Instruction ID: 7878cb228ebfe72690f9a6667967b9dfc6b43362d49cc0e87efeb04ca6405973
Opcode Fuzzy Hash: 9db35c6cc3225dfe3c3b48e6993cb934fbf882369def35dca21c97ceffb762d1
Instruction Fuzzy Hash: C22125B19002498FDB14DFAAC4857EEBFF4AF88324F14842ED459A7351CB789A44CFA4

Function 09830B38 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 09830BB8

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2a4b5d38f362b454a5f792c56060db5948e25d557d99a1f682f0a2a6be1e40d7
Instruction ID: 0ecff5b143a30d875d54f6d23e4b89965bdab0009db89e59c4ddfa5f967f38b1
Opcode Fuzzy Hash: 2a4b5d38f362b454a5f792c56060db5948e25d557d99a1f682f0a2a6be1e40d7
Instruction Fuzzy Hash: 6B2128B1800359DFCB10DFAAC840ADEBBF5FF48320F508429E559A7250C778A544CBA4

Function 09830478 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 098304F6

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ca25013028764005065b5c342f47d0abfa577fa1ac1c75fed3c1b1f1623ae319
Instruction ID: c1af370c9265b89c25f593063a81e35aa3c1ac75525668697ee2624d3f8f20db
Opcode Fuzzy Hash: ca25013028764005065b5c342f47d0abfa577fa1ac1c75fed3c1b1f1623ae319
Instruction Fuzzy Hash: 492107719002098FDB10DFAAC4857AEBBF4AB48324F548429D559A7241D778A944CFA4

Function 09717F54 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,09718382,?,?,?,?,?), ref: 09718427

Memory Dump Source

Source File: 00000000.00000002.1849611989.0000000009710000.00000040.00000800.00020000.00000000.sdmp, Offset: 09710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9710000_DHL Delivery Invoice.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 7dd5200700c5dcfde55f61654b169da48b9397dfcade8fa7dcadd0beca82b030
Instruction ID: 674fec9d57cec5e2f3f146c1818229425294bab8c5448937feb397586515b1a8
Opcode Fuzzy Hash: 7dd5200700c5dcfde55f61654b169da48b9397dfcade8fa7dcadd0beca82b030
Instruction Fuzzy Hash: AD1179B2800349DFCB10CF9AD844BDEBFF8EB48360F14841AE954A7210C375A950CFA5

Function 09830981 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 098309F6

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 51b7d1828ca57ccea44b84fbf80b3e65fe5b8cda94c3f871f70ef194b60d0960
Instruction ID: 52f2ea973171a7b885c000f900a8fc463224c5c00eec456b690bd0fe533a42b4
Opcode Fuzzy Hash: 51b7d1828ca57ccea44b84fbf80b3e65fe5b8cda94c3f871f70ef194b60d0960
Instruction Fuzzy Hash: 81116772800249CFCB10DFA9D944BEEBFF5EF48324F20881AE555AB260C775A585CFA0

Function 09830988 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 098309F6

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5ca617266b6f1c0d7dcd74ab1229890c2b447dddf75c42b536dffbc24013d8b2
Instruction ID: bb57ae23ce38ffdfbae0999361365a4327ff75a67dabe3b843e9d0fb179119ef
Opcode Fuzzy Hash: 5ca617266b6f1c0d7dcd74ab1229890c2b447dddf75c42b536dffbc24013d8b2
Instruction Fuzzy Hash: FA1123729002499FCB10DFAAC844ADFBFF5EB88320F208819E559A7250C775A954CFA0

Function 097EFC60 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 097EFCCA

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1def0075a9de7b332ab46dacfaff6600bfae02f68a28fb8413f8fa4088193fcb
Instruction ID: f70c5bf86a4dc38dc677ae7afdd218a8a797526c020e7677e412c408e849eb72
Opcode Fuzzy Hash: 1def0075a9de7b332ab46dacfaff6600bfae02f68a28fb8413f8fa4088193fcb
Instruction Fuzzy Hash: 271128B19003498FCB10DFAAC54579FFBF8EB88324F24882AD459A7260CB75A544CFA4

Function 097EFC68 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 097EFCCA

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 92ab181a275634c9d9842d404c5f85ababeeac22da63e611bf23875c3208506c
Instruction ID: e141b37f59a114ae59ce2ea7e768e5cc5147c6ef4c2e748c1b019ff9e5371a01
Opcode Fuzzy Hash: 92ab181a275634c9d9842d404c5f85ababeeac22da63e611bf23875c3208506c
Instruction Fuzzy Hash: A4113AB19003498FCB10DFAAC4457DEFBF4EB88324F248829D459A7250C775A544CF94

Function 09834CE0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 09834D45

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f05c15e848ba51aeda54855ecd91d2e58e64c851a1bdba3a95038187493d67ed
Instruction ID: ad19b6c25d517f2802a3a6dc7620485cbb52d31946c91ab530284dbfe306e52e
Opcode Fuzzy Hash: f05c15e848ba51aeda54855ecd91d2e58e64c851a1bdba3a95038187493d67ed
Instruction Fuzzy Hash: DC11F5B5801349DFDB10CFA9D488BDEBBF4EB48324F108459E554A7250C375A584CFA1

Function 09834CE8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 09834D45

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 327402d1c79a49af49630b4175567f9adfa6e8941c24d34b9a9b42716995f9d9
Instruction ID: 9175769c3a29593d045494ff076ad31b4d3428414d5d51d0150555d55572bfa8
Opcode Fuzzy Hash: 327402d1c79a49af49630b4175567f9adfa6e8941c24d34b9a9b42716995f9d9
Instruction Fuzzy Hash: 3111D0B5800349DFDB10DF9AD885BDEBBF8EB48324F10845AE558A7310C375A984CFA5

Function 00D5D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824354281.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12641042776d74755a8db4e99efeb6605c3fafc108f50abe15b70fee37d0e1e8
Instruction ID: 009847e83df0fdcc2df5fe39b51d62d58716ea96eae3b10d9b6184a8145566b5
Opcode Fuzzy Hash: 12641042776d74755a8db4e99efeb6605c3fafc108f50abe15b70fee37d0e1e8
Instruction Fuzzy Hash: 16212571500204DFDF25DF14D9C0B26BF66FB98325F24C169ED494B25AC33AE85ACAB2

Function 00D6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824421155.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d6d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a52aad66b21602e30c429ca16fef027ee93009beca535d57f6b9866f6e949cb
Instruction ID: d64dc52d5abb9112ee9d2d8739dbebe98c76e28d962de4a0b7fccf4e5ac42a0a
Opcode Fuzzy Hash: 7a52aad66b21602e30c429ca16fef027ee93009beca535d57f6b9866f6e949cb
Instruction Fuzzy Hash: 1921F275A04240DFCB14DF14E984B26BBA6EB88314F24C569E84A4B296C33BD847CAB1

Function 00D6D39C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824421155.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d6d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13114ef89c79a8ceb7f7c22efb32501df054cf1ee4ff83466d743aeb59bdf5b7
Instruction ID: cb42b78ee76d89c6f448d01ab45b678cbf4ba369bd3ac58e2fba3fd83d308893
Opcode Fuzzy Hash: 13114ef89c79a8ceb7f7c22efb32501df054cf1ee4ff83466d743aeb59bdf5b7
Instruction Fuzzy Hash: 6121F2B1A44204DFCB04DF14E9C4B26BBA6EB84314F24C56DD9494B396C73AE846CA72

Function 00D6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824421155.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d6d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb609f7dafee196eeef9619cb1b4ed5ff3f8bdb688283beb9f1d1950c18395f
Instruction ID: e78582fb309b2a8dae42ca3af5720f606e5ad4e1dfed664ce4259ca6fcc3090c
Opcode Fuzzy Hash: 7bb609f7dafee196eeef9619cb1b4ed5ff3f8bdb688283beb9f1d1950c18395f
Instruction Fuzzy Hash: 912150755093808FDB12CF24D994715BF72EB46314F28C5EAD8498F6A7C33A980ACB62

Function 00D5D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824354281.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 7209486c6df5024fd7150b03f0f9aecd5ed57e47039c2f1e5d740f88515f378c
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: BA11CD72404240CFDF16CF00D5C4B16BF62FB94324F28C2A9DC090A256C33AE85ACBA1

Function 00D6D397 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824421155.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d6d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 8c5b47043aeb4bb062f7503dbc740b5b2c47f0ee7c8e82ecf6db81791935e94c
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 22119075A04284DFDB05CF14E5C4B15BF62FB84314F28C6ADD8494B656C33AE84ACB61

Non-executed Functions

Function 02AA5AE8 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

*w, xrefs: 02AA5C20
*w, xrefs: 02AA5C19

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: *w$*w
API String ID: 0-2919693051
Opcode ID: 28a716a60f7b1554b3fde21e3db1eb2dda4a1c8da6ca62848b0d7c8649b129d1
Instruction ID: 12f701873ce822622d1127c8b9c330de8994aff8f6f0bd7f1925fbdcdce3ed1f
Opcode Fuzzy Hash: 28a716a60f7b1554b3fde21e3db1eb2dda4a1c8da6ca62848b0d7c8649b129d1
Instruction Fuzzy Hash: EC41D8B0E0560ADFCB44CFAAC5915AEFBF2BF89300F64D46AC515A7214E7349A41CF98

Function 02AA5AF8 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

*w, xrefs: 02AA5C20
*w, xrefs: 02AA5C19

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: *w$*w
API String ID: 0-2919693051
Opcode ID: d6bf83afd9a4635effcb46fef3ef98c2f7f0b2dde9fb4955f9b6ec2f20949efb
Instruction ID: b6ea982943c71187a2aba82397b85c7cc19c6e3cfeb14c0db875640778ef4950
Opcode Fuzzy Hash: d6bf83afd9a4635effcb46fef3ef98c2f7f0b2dde9fb4955f9b6ec2f20949efb
Instruction Fuzzy Hash: BD41E7B0E0160ADBCB44CFAAC5515AEFBF2BF88300F64D46AD515B7214EB349A41CF98

Function 097E2B60 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

4'kq, xrefs: 097E2C42

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: b4bc1cceecbec2ad5b197f8bd9878b19264ca3a2dcefe4643f20eee936887167
Instruction ID: a736618b989e31fc4166b622bc52fa5d53c07b241e3ecb8b601a52d90a02642a
Opcode Fuzzy Hash: b4bc1cceecbec2ad5b197f8bd9878b19264ca3a2dcefe4643f20eee936887167
Instruction Fuzzy Hash: C0714E70E002098FDB4CEF6EE84169ABBF6FB88344F14D129D4059B269EF785905CB94

Function 097E2B70 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

4'kq, xrefs: 097E2C42

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 5e26f2b71b9166ef6cff1503b9250629a96b328ee23f04190666a5039ba7ee76
Instruction ID: 1c60e5cfabce5b43517ce47e954862e1476f3a31b668434cb73446c4a022f8a8
Opcode Fuzzy Hash: 5e26f2b71b9166ef6cff1503b9250629a96b328ee23f04190666a5039ba7ee76
Instruction Fuzzy Hash: F6613D70E002098FDB08DF6EE94169ABBF6FB88344F14D529D4059B369EF7859098B94

Function 02AA56E8 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

!yqo, xrefs: 02AA585F

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: !yqo
API String ID: 0-2311287014
Opcode ID: afd646740b8232c5a5a52b0c0c8a2893543e149c3845d751acfdebb174adefbb
Instruction ID: 3f6fffc76536a1287ba71a70005bdd01e4da1ff97977f446783880c5f3e472c0
Opcode Fuzzy Hash: afd646740b8232c5a5a52b0c0c8a2893543e149c3845d751acfdebb174adefbb
Instruction Fuzzy Hash: C641C3B0D0420ADBDB44CFAAC9915AEBBF2AF88300F64D46AD415B7254E7349A42CF94

Function 02AA56F8 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

!yqo, xrefs: 02AA585F

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: !yqo
API String ID: 0-2311287014
Opcode ID: 655fade3b360b9749d95d4e274e6933071160fdb7a41e7d6cce95b2d9ae6f718
Instruction ID: 5be6f38027eb603b4fc69b3fdcbb701bb1f5db493610b1c8461dcb82fb9be1a9
Opcode Fuzzy Hash: 655fade3b360b9749d95d4e274e6933071160fdb7a41e7d6cce95b2d9ae6f718
Instruction Fuzzy Hash: 5341D7B4D0420ADBCB44CFAAC9915AEFBF2BF88300F54D469D515B7254D7349A42CF94

Function 097ED8E0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a79c8e7e55a233f31ffd049305e2f0bb884e09cf177edba6a2562a181c19f3
Instruction ID: 8b80fecbc7d46371d34c3ee320685449906882535165733fadb3b5bc2a2a4cca
Opcode Fuzzy Hash: 47a79c8e7e55a233f31ffd049305e2f0bb884e09cf177edba6a2562a181c19f3
Instruction Fuzzy Hash: ACE10875E002198FCB14DFA9C5809AEFBB2FF89304F24916AE415AB366D734AD41CF60

Function 09830040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51af95448832b28ed39439535d25920bd5ad5929d0179b2ca6dc7f5c972a784
Instruction ID: e63a115379fa21bec7931d1ba38a40cdecfff81a6d6d41393096a58798167532
Opcode Fuzzy Hash: f51af95448832b28ed39439535d25920bd5ad5929d0179b2ca6dc7f5c972a784
Instruction Fuzzy Hash: 01E1D674E002198FCB14DFA9C5809AEBBB2FF89304F64D169E414AB356DB34AD41CFA5

Function 09830550 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1850183523.0000000009830000.00000040.00000800.00020000.00000000.sdmp, Offset: 09830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9830000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801ab6f4127bf84c144d877aa3587ec16e2ecdf07c9d32154487c03dd186b816
Instruction ID: 7f89ab202c6517b9dee4858fa4cf8457062203c37e228108e6ae81938a78d9ba
Opcode Fuzzy Hash: 801ab6f4127bf84c144d877aa3587ec16e2ecdf07c9d32154487c03dd186b816
Instruction Fuzzy Hash: F9E1F874E012198FCB14DFA9C5809AEBBB2FF89304F24D269E415AB356D735AD41CFA0

Function 097EDD38 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ca88718a39785e820ed8c7b759209bc9b39d572aaf1a6b25f31fa6578bd037
Instruction ID: 5fff37daa364a5fdae162f31d8cd0e541f84598fbe68599ab8573b78f2cefb99
Opcode Fuzzy Hash: 47ca88718a39785e820ed8c7b759209bc9b39d572aaf1a6b25f31fa6578bd037
Instruction Fuzzy Hash: EBE1F675E002198FCB14DFA9C5809AEFBB2FF89304F249169E414AB356DB34AD41CFA4

Function 097EE170 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849886407.00000000097E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 097E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97e0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b214da789988c0e6cd981754326246f42b5ffd99eda275e4d8f70ca94f33ecf
Instruction ID: bb13e111606cfb3b0c94418201b39d4b2485e26098426630e5495a5036cfc4d5
Opcode Fuzzy Hash: 3b214da789988c0e6cd981754326246f42b5ffd99eda275e4d8f70ca94f33ecf
Instruction Fuzzy Hash: 83E1F675E002198FCB14DFA9C5809AEFBB2FF89304F249569E414AB356DB30AD41CF65

Function 02AA4FF0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b08d8859af70f24fd38b08ddb3288bdd90dbe4e25c02235cbd074eea578b4a9
Instruction ID: 5dd5f15716f697980533fdad8e044eb602f0189ca2d509fa98a46f7a2c135c63
Opcode Fuzzy Hash: 5b08d8859af70f24fd38b08ddb3288bdd90dbe4e25c02235cbd074eea578b4a9
Instruction Fuzzy Hash: 3E715A74D0420ACFCB04DFA9D4919AEFBB2FF49310F54941AD415A7315DB34AA82CF98

Function 02AA4FE0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4d8536ddaece0857f985530db07eeaab45647634e1338d8dc291f89decb8ec
Instruction ID: 35c05b6fd2fd28f50b3e765ffdfafe2aff72d1398ad6ed4477a4516cf529cfd8
Opcode Fuzzy Hash: 0f4d8536ddaece0857f985530db07eeaab45647634e1338d8dc291f89decb8ec
Instruction Fuzzy Hash: 16614774E0520ACFCB04DFA9C4919AEFBB2FF49310F54952AD415A7315DB34AA82CF98

Function 02AA2148 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f728eda916d4e6be9e5e010fc995649f9f40b8b16140b7d329cce76ad59fdb92
Instruction ID: 5c5025a87e7869a1e57a2f599ccef1b09273286510e969cbfef24d3efdeb0197
Opcode Fuzzy Hash: f728eda916d4e6be9e5e010fc995649f9f40b8b16140b7d329cce76ad59fdb92
Instruction Fuzzy Hash: AF613674E01209DFCB04CF99D490AEEFBB1FF88310F149569E915AB250D7309A96CFA4

Function 02AA58B0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fb9a4b0318f4ae4b95bf84e039bf7ba331ed3febdf0096e4ed353ab10b3429
Instruction ID: 4519407afe1eabcb8f32e342d478c8d894ec4f09f7da914d326fd78f2e2f28c0
Opcode Fuzzy Hash: c5fb9a4b0318f4ae4b95bf84e039bf7ba331ed3febdf0096e4ed353ab10b3429
Instruction Fuzzy Hash: BC61E274E15219DFCB48CFAAC9805DEFBF2BF89210F64952AD415BB214D7309A41CF68

Function 02AA58A0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973a7befa3b69734d74d4c5a90572402de06095fa17d0fdd6a863bcdb04d6933
Instruction ID: 6019b75852195d7b239c50d3c04293032d64d98fa38c97f9d1013de0c6b6b7c0
Opcode Fuzzy Hash: 973a7befa3b69734d74d4c5a90572402de06095fa17d0fdd6a863bcdb04d6933
Instruction Fuzzy Hash: E6610374E052199FCB44CFA9C9809DEFBF2BF89210F64952AD405BB314D7309A42CF68

Function 02AA0870 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826018575.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9841e2323e069323a7c50474283226a838666cbb591e4b4245a5ba2ddd20e52
Instruction ID: d4bdd0bdd6871bd32efa93b2f8b80847b579886317e789ec3b50380c0579117b
Opcode Fuzzy Hash: e9841e2323e069323a7c50474283226a838666cbb591e4b4245a5ba2ddd20e52
Instruction Fuzzy Hash: 2A41EA70E016189FDB58CF6AD94079EFBB3AFC9300F04D0AAD508AB225EB305985CF55

Analysis Process: DHL Delivery Invoice.exePID: 2032, Parent PID: 6724COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	6

Executed Functions

Function 065330E0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 065337DF
$kq, xrefs: 065337EB
$kq, xrefs: 06533814
$kq, xrefs: 06533838
$kq, xrefs: 06533808
$kq, xrefs: 0653382C

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: a5627848dacfd73158babbc06542d8261599f99b3fdcd3fd34b03d929166d463
Instruction ID: 6f3cd6191dc1292a496d183dbcd5d97630476fddfba0b206289667dc19e5b31e
Opcode Fuzzy Hash: a5627848dacfd73158babbc06542d8261599f99b3fdcd3fd34b03d929166d463
Instruction Fuzzy Hash: 02321F31E1065ACFCB14EF65D99459DF7B2BFD9300F20C6A9D409A7264EB30A985CF90

Function 06537DD8 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06538121
$kq, xrefs: 06538115

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 695033b0381f0f305409ef1ca5d7a00f2281415f8b011e6d54144df9e76c3930
Instruction ID: 4af507b4f103aee29f3ac9e5b5b8527f0c956fc299cbe1b45eb552166d24f990
Opcode Fuzzy Hash: 695033b0381f0f305409ef1ca5d7a00f2281415f8b011e6d54144df9e76c3930
Instruction Fuzzy Hash: BF02AF30B002258FDB58DF65DA54AAEB7F2FF84700F148569E5159B3A9DB35EC82CB80

Function 06532408 Relevance: 1.0, Instructions: 1005COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d07296bd45cf806177e8c542f8211582f346f68f56b052e5742e4cf31b0c3e4
Instruction ID: 9325890e37c202ec6cb4954aaddbedd013c3529b4c9a8468064d78017d1ef053
Opcode Fuzzy Hash: 3d07296bd45cf806177e8c542f8211582f346f68f56b052e5742e4cf31b0c3e4
Instruction Fuzzy Hash: F0925530A006248FDB64DF68C584A6DB7F2FF44714F5488A9E44AAB365DB35EE85CF80

Function 06536648 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ecff2c88f7199b73b1d5bf02ff8d9fd8ae6f8fb9b3df96e63f591f837c2b24
Instruction ID: 46a76e779407a14cd8dee4ee1c9f31d2da6dd5215f0fea58bbf471cd85bb6823
Opcode Fuzzy Hash: 24ecff2c88f7199b73b1d5bf02ff8d9fd8ae6f8fb9b3df96e63f591f837c2b24
Instruction Fuzzy Hash: F1629B34A002299FDB54DB68D594AADB7F2FB88750F248469E806EB394DB35ED41CF80

Function 0653C1E8 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047349fb9b8a89ad507f93d84394bfc20b001cdad49f19b8de3d47451382d35c
Instruction ID: fc220624aba6afc39edcd7620c91692cdce79bbf3756954e6f6f50de33d53ff9
Opcode Fuzzy Hash: 047349fb9b8a89ad507f93d84394bfc20b001cdad49f19b8de3d47451382d35c
Instruction Fuzzy Hash: A8328F34B102198FDF94DB68D990BAEB7B2FB88710F108569E506EB359DB35EC41CB90

Function 06535628 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e970b9bdf1c6ba5535a80522a4316c29f34e30144a5989cca88a09c701b04dd
Instruction ID: 6f32f9afae6008bb2b90fc98666185b1853ea028544789eb70159e1250042c38
Opcode Fuzzy Hash: 8e970b9bdf1c6ba5535a80522a4316c29f34e30144a5989cca88a09c701b04dd
Instruction Fuzzy Hash: C512D175E002298FDF64DB64D9806AEB7B6FB84710F249429E906DB385EB34ED41CB90

Function 0653B282 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398d3398aac9d049896c98b487ae453b9bc6136408305db9a07870bede927db6
Instruction ID: af624707254926503062dbbf94354643e487f9a833eb9f7e4c040b9e941ffa5b
Opcode Fuzzy Hash: 398d3398aac9d049896c98b487ae453b9bc6136408305db9a07870bede927db6
Instruction Fuzzy Hash: 4D228030E102298FDFA4DB68C5807AEB7B6FB99710F248526E405EB395DA35DC81CF91

Function 0653AD28 Relevance: 10.4, Strings: 8, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0653AEF4
$kq, xrefs: 0653AEA8
$kq, xrefs: 0653AF00
$kq, xrefs: 0653AE55
$kq, xrefs: 0653AED7
$kq, xrefs: 0653AE49
$kq, xrefs: 0653AE9C
$kq, xrefs: 0653AECB

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: 38b70714bac3a314243543412249808f5bb65c355fe59b06b6a9c324581cc768
Instruction ID: ae6d77c70641ca4cc63b3cfa864a9acf74bcb812002013550c0ea26095d96479
Opcode Fuzzy Hash: 38b70714bac3a314243543412249808f5bb65c355fe59b06b6a9c324581cc768
Instruction Fuzzy Hash: BAE17030E102198FCF65DBA9D5806AEB7F2FF85700F208929E419AB355DB75D846CB90

Function 0653B6A0 Relevance: 8.0, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0653BC35
$kq, xrefs: 0653BC01
$kq, xrefs: 0653BC0D
$kq, xrefs: 0653BC41
$kq, xrefs: 0653BC75
$kq, xrefs: 0653BC69

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 65dec04a4bb59256ada003f2ba437eebaf140de1c24f489c4f26c96895afb8ce
Instruction ID: 74c45b9b824eb6145e373161f0a1c85b72980d1b7029964ab548c52cb9eeebc1
Opcode Fuzzy Hash: 65dec04a4bb59256ada003f2ba437eebaf140de1c24f489c4f26c96895afb8ce
Instruction Fuzzy Hash: 12028B30E1022A8FDFA4CF68D5806ADB7B2FB95710F24896AE405DB355DB34ED81CB91

Function 065391A0 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06539210
$kq, xrefs: 06539257
$kq, xrefs: 0653921C
$kq, xrefs: 0653924B

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 78447271d2886241a389b22b554d01c2a1cbbaeacd1d22f72e4409da32f8d649
Instruction ID: 0a65a15af23b4e4366ed322453ab3bb512569c2fefad5edc7ae70cfb0d52775b
Opcode Fuzzy Hash: 78447271d2886241a389b22b554d01c2a1cbbaeacd1d22f72e4409da32f8d649
Instruction Fuzzy Hash: 1F917E70F0061A8FDB64DF65DA507AEB3B6BF84640F108469D809AB398EB75EC518F90

Function 0653CFA8 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0653D3A3
$kq, xrefs: 0653D3AF
$kq, xrefs: 0653D39B

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq
API String ID: 0-2086306503
Opcode ID: fa1d6d848967aad97a44b6cbcfb3014ddfe1843825a786f9fab9227945c424e0
Instruction ID: 96f15e9ee8f3a9b307e4ef40cc82c6a0e6141eabda3248b1500348e1b49508c2
Opcode Fuzzy Hash: fa1d6d848967aad97a44b6cbcfb3014ddfe1843825a786f9fab9227945c424e0
Instruction Fuzzy Hash: 85625330A102198FCB55EF68D690A5EB7B2FF85700F20CA69D4059F369DB75ED86CB80

Function 06534BF0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Opq, xrefs: 06534DA7
fpq, xrefs: 065352FD
XPpq, xrefs: 06534D1D

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: 60085f105f18484adbde6360de72be969c12daa1b5e9ec2040c9693f49d1705c
Instruction ID: 4be2cf7c64418e5395f59f84fb5f029bc62d99d3425c88a3b334fc4a1d54e742
Opcode Fuzzy Hash: 60085f105f18484adbde6360de72be969c12daa1b5e9ec2040c9693f49d1705c
Instruction Fuzzy Hash: EC617071F002199FEB549BA4C914BAEBBF6FB88700F208429E506AB395DF758C458B91

Function 06539193 Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06539210
$kq, xrefs: 0653924B

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: eb0a725d7b56809cb33e8a020d71731364e048276f007448abc842afa7687810
Instruction ID: c79ebaf03e60f99c577f5f39d825046d10981eca55c80d15b385fd142d0fce34
Opcode Fuzzy Hash: eb0a725d7b56809cb33e8a020d71731364e048276f007448abc842afa7687810
Instruction Fuzzy Hash: 7B514E70B005159FDB64DB69DA50B6EB3F6BB88640F108469D80A9B398EB75EC11CB90

Function 00E8EB30 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4258736998.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e80000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89e2344d3d96b12f9aa09eeaf60f03ceb382dfb55379d24e02e29e14920b320
Instruction ID: 280407d4eb30915345eae79d7b52f3bfd8cc25a713341d7b90861bac0f160180
Opcode Fuzzy Hash: d89e2344d3d96b12f9aa09eeaf60f03ceb382dfb55379d24e02e29e14920b320
Instruction Fuzzy Hash: A4413272D003998FCB14EFB9D9042EEBBF1AF89310F15856AD409E7351EB349845CB90

Function 00E8EC18 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00E8EC7F

Memory Dump Source

Source File: 00000009.00000002.4258736998.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e80000_DHL Delivery Invoice.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a7feb192edb4decdb6d52b75e0171d3c00a67207679cf8f8e4ad881fc9199f0a
Instruction ID: 00025f3cf40862cad89d6ba771416e27d4b075358d9c9d444b03fcc2b9e7a3d1
Opcode Fuzzy Hash: a7feb192edb4decdb6d52b75e0171d3c00a67207679cf8f8e4ad881fc9199f0a
Instruction Fuzzy Hash: B111F0B2C006699BCB10DFAAC544BDEFBF4AF48324F15816AD818B7250D378A944CFE5

Function 06534BE0 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

XPpq, xrefs: 06534D1D

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: XPpq
API String ID: 0-1266478781
Opcode ID: d0a7dd4f4da7e090f1e95f6a66ccd36d96cfc41444c16c818214baa5286eac35
Instruction ID: fcad7fbd34903f4b8157a541ce4d9bd6bc9efe59e4dd1b607aa81f52b19be684
Opcode Fuzzy Hash: d0a7dd4f4da7e090f1e95f6a66ccd36d96cfc41444c16c818214baa5286eac35
Instruction Fuzzy Hash: 7A417F71E102189FDB54DFE4C954BAEBBF6FF88700F20C529E506AB399DA748C458B90

Function 0653DB15 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0653DC71

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 2b2db83efb79f4c37a55c063711db06349c3d32bfdd313ee4f927e0adc679665
Instruction ID: 90d2d4ee0da36464eb93c50934658afd48f91b38e0768b61209c1711f8e8d864
Opcode Fuzzy Hash: 2b2db83efb79f4c37a55c063711db06349c3d32bfdd313ee4f927e0adc679665
Instruction Fuzzy Hash: 5D41CD30E107599FDB65DF65C5906AEBBB6BF85700F208A2AD402EB250DBB5D846CF80

Function 0653227D Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PHkq, xrefs: 065323CB

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 7973aed206c99e5ae5b4425a42e99de052f7d2ac9df35288a9d47ef49d33d4d0
Instruction ID: 2bfaa4a995b3821a2d8c25f5d8c0e9547f8f7c131a6fa983ac36354eac7978ac
Opcode Fuzzy Hash: 7973aed206c99e5ae5b4425a42e99de052f7d2ac9df35288a9d47ef49d33d4d0
Instruction Fuzzy Hash: B8311431B002258FCF54AB74CA506AE7BA3BF88600F20846CE006DB395DF35CD46CB90

Function 06532290 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHkq, xrefs: 065323CB

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: c080d4b4d809ed979d74ecb49c80ba0b6196028df22d34f558dbab08955a8418
Instruction ID: 6d11ab2d492d270a32855cd31dbbc0562c2f0b2f9fd45b2bad9a1597c30a8135
Opcode Fuzzy Hash: c080d4b4d809ed979d74ecb49c80ba0b6196028df22d34f558dbab08955a8418
Instruction Fuzzy Hash: B131DE31B006158FDF58AB74DA546AE7BE7BB88600F208428E406DB399DF35DE46CB91

Function 06536248 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb0a39c5afe36f7b93b2bc09fbd481301ccb2ec897014c766ab7ab86c7810a1
Instruction ID: 8700e04f45857229c467c4df1bd73e2ac3d31040786acd91aa887ba895d3393e
Opcode Fuzzy Hash: 3bb0a39c5afe36f7b93b2bc09fbd481301ccb2ec897014c766ab7ab86c7810a1
Instruction Fuzzy Hash: 0261B2B2F001214FCF559A7DCD80A6EAAEBAFD4620B154439E80ADB379DE65DC0287C5

Function 06534321 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c59e4c4735b94281854ff5c872f0d19543f41d4044bf17efecc3e78d9880bb
Instruction ID: 442ae3e129d85ab2c1f789a87d5ad0a758445510b0564a53edbc92dfbe68dc89
Opcode Fuzzy Hash: 06c59e4c4735b94281854ff5c872f0d19543f41d4044bf17efecc3e78d9880bb
Instruction Fuzzy Hash: 79815D30B106198FDF54DFA9D5546AEB7F6BF88700F108529E40ADB399EB34DC828B91

Function 06534640 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbecd307d5f64747ca1bc8284f2dad38462c7a81ed9d158f13831e8641870f06
Instruction ID: 04aa9ffcf526b7e9c830f5218e4544e7e6bc4d166d8f9fbc10d1339323dc0431
Opcode Fuzzy Hash: cbecd307d5f64747ca1bc8284f2dad38462c7a81ed9d158f13831e8641870f06
Instruction Fuzzy Hash: 9D913B30E106198FDF60DFA8C950B9DB7B1FF89310F208599E549BB295DB70AA85CF90

Function 06534658 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfef2e8697dbc604054bf546a863f9a38d8bc82ce2690f45021e9eee2ebed142
Instruction ID: cdbdc3d1d4e814dbd92b74097beb9ca1f0fe02b6267781f29769ac081fd19841
Opcode Fuzzy Hash: bfef2e8697dbc604054bf546a863f9a38d8bc82ce2690f45021e9eee2ebed142
Instruction Fuzzy Hash: F0912C70E106198BDF60DFA8C940B9DB7B1FF89310F208599D549BB355DB70AA85CF90

Function 0653EB78 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a567ecac4460d3a948a0f61d75e52f640b75970e191aadbd4faadffd6374f527
Instruction ID: 787c8e04d2e9da29476a49b48c30095cba0477cf95b5b1941ea21a0371ac73b5
Opcode Fuzzy Hash: a567ecac4460d3a948a0f61d75e52f640b75970e191aadbd4faadffd6374f527
Instruction Fuzzy Hash: 66711B71A002199FCB54DFA9D991AAEBBF6FF84700F14C42AE405AB355DB30ED46CB50

Function 0653EB68 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389ecf5544c31008dc29575b6520743ab230646a563d78274a33dfcbd459fce1
Instruction ID: e00ae8a4e5495e86dea8568393c99340c9da6283d8cf825843ea8b8f3b983da2
Opcode Fuzzy Hash: 389ecf5544c31008dc29575b6520743ab230646a563d78274a33dfcbd459fce1
Instruction Fuzzy Hash: 36713D70A006199FCB55DFA8D991AAEBBF6FF84700F14C82AE405AB355DB30ED46CB40

Function 0653FA88 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3c164a06c6d59d648b93657bd1e613414bd026883c4f2822ba892e6418f101
Instruction ID: d9d11433ff8deac7fc3143abbd2b014ec39495d19100dfb0ad7547d7ac7a4dc8
Opcode Fuzzy Hash: ce3c164a06c6d59d648b93657bd1e613414bd026883c4f2822ba892e6418f101
Instruction Fuzzy Hash: C251B730F602249FEFA4566CD95476F379EF78A710F10482AE50AE73E9CA2DCC4547A2

Function 0653FCD9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f06945053505ee17485fc1bda5704c78d2576d636a914fe0177da4483fb492
Instruction ID: 53791ff438bf0026dd36cff82595b5640f7930fcf2fac57c2807f8f349ed2c39
Opcode Fuzzy Hash: d0f06945053505ee17485fc1bda5704c78d2576d636a914fe0177da4483fb492
Instruction Fuzzy Hash: 4051D131E00215DFCB54EBB8E5586ADBBB2FF88715F20886AE106D7350DB358845CB90

Function 0653FA98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe9d48a2145a6302110c6192d1d25182290e1e440a202fc1d146b53085fce6ee
Instruction ID: 61a890119ae2de7f8a682356ed00de4b71e0bfe62d3abf4983b1f9e8db444a8c
Opcode Fuzzy Hash: fe9d48a2145a6302110c6192d1d25182290e1e440a202fc1d146b53085fce6ee
Instruction Fuzzy Hash: FC51C730F602249FEFA4666CD95472F375EF789710F20482AE50AE73E8CA2DCC4547A2

Function 06535499 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cd9f169b59338ef6aab5719516e0dabbab6e88e8f7f3b9ae668cb3ffb9e558
Instruction ID: b735bfcf232291154969d21408515d89330bc8e46289f782b18117a671e9b600
Opcode Fuzzy Hash: 63cd9f169b59338ef6aab5719516e0dabbab6e88e8f7f3b9ae668cb3ffb9e558
Instruction Fuzzy Hash: C0414B71E006199FDF60CEA9D880AAFF7B2FB84710F10492AE156D7654E330E9598F91

Function 06535618 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3014bdbd73bbe67dc71f30e48b57c2a40adc2598d097143ff741d9b356598593
Instruction ID: eb19e1064a1dc1beb3a8e521a05f7190b1080581833f88a571033d87c16c69c3
Opcode Fuzzy Hash: 3014bdbd73bbe67dc71f30e48b57c2a40adc2598d097143ff741d9b356598593
Instruction Fuzzy Hash: 6941C174E002158BDF61CB68C880ABEFBF2FB45750F24D926E459DB241E634D841CF91

Function 06532140 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8977ba9069d9c912079affdcc9876a4c7f9d759e6286cdea08d1da2a74dd3f7f
Instruction ID: 9ccaa8583c811def683612481a230b02e414ffa16682abe528c77b16c5fd1696
Opcode Fuzzy Hash: 8977ba9069d9c912079affdcc9876a4c7f9d759e6286cdea08d1da2a74dd3f7f
Instruction Fuzzy Hash: 72319C31E106199FDB19DFA4D994A9EB7B2BF88700F10C529E806E7354EB71ED46CB80

Function 06532150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb356d97cee0b98fbc0f4915b8dcd0f85e1d579961fb6ac77abf3a0a2166d77
Instruction ID: 164c6c787133fb8125cfb502e6728b6a7146a4f7c6c16eeba034b11e29f294d1
Opcode Fuzzy Hash: 0cb356d97cee0b98fbc0f4915b8dcd0f85e1d579961fb6ac77abf3a0a2166d77
Instruction Fuzzy Hash: DA318B31E106199BDB19CFA4C954A9EB7B6BF88700F10C529E806E7354EB71AD41CB80

Function 06533B21 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fdfeafe0987a83a1d67136ff621af57b4986f472656c334d91191b04c08708
Instruction ID: e118288f6d44380012ecacd696cf0938a6254322bf2ebad4730bf6e6f6008bc2
Opcode Fuzzy Hash: 31fdfeafe0987a83a1d67136ff621af57b4986f472656c334d91191b04c08708
Instruction Fuzzy Hash: C7219C75F01A159FDB10DF69E980AAEBBF1BB48710F00846AE909EB354E730D851CB90

Function 06533B30 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447f61eaafabdd65274920edf3ea7e6a5e7a8db55f8752dc451d07e248137bf0
Instruction ID: ec5cd6ffe56ae5617f5b7918b359c89099edfa429baa2158c597809a58152642
Opcode Fuzzy Hash: 447f61eaafabdd65274920edf3ea7e6a5e7a8db55f8752dc451d07e248137bf0
Instruction Fuzzy Hash: D2218E75F01A299FDB50DF69D980AAEB7F1FB48B10F10846AE909EB354E731D840CB94

Function 00B0D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256567066.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b0d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffbf770baafac9f3680ddcd4c0b0f0e7a6ac16be43fb5921fc7a081fb6117cc
Instruction ID: 5d98fdffe1ef8edbc2f65e6dee3a7e437e2047c6bb3c5a7b6aa0a51ba98514fb
Opcode Fuzzy Hash: 7ffbf770baafac9f3680ddcd4c0b0f0e7a6ac16be43fb5921fc7a081fb6117cc
Instruction Fuzzy Hash: CA210171604204DFCB04DF54D9C4B2ABFA5FB84314F20C6ADE80A4B3D6C37AE846CA62

Function 00B0D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256567066.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b0d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9788e6e366cdbbd3eb0e8c4546a82ba134de07144de80641c2bdd68e6a30b632
Instruction ID: ac809e7127cee0d34117623b965497aa4d831d2a3195309e257ec722461491e8
Opcode Fuzzy Hash: 9788e6e366cdbbd3eb0e8c4546a82ba134de07144de80641c2bdd68e6a30b632
Instruction Fuzzy Hash: 9B213471504204DFCB10DF64C9D4B26BFA5FB84314F20C5ADE84D4B2D2D73AD846CA61

Function 00B0D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256567066.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b0d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0064c51e488b0904e5d87332fdb5e22c7adaeb0d1fca3ef2234704744d335001
Instruction ID: 5359b01e5bcce0779d1e6b9f240eb0c6adf7516691b219b5a77ff9473c7b9ad5
Opcode Fuzzy Hash: 0064c51e488b0904e5d87332fdb5e22c7adaeb0d1fca3ef2234704744d335001
Instruction Fuzzy Hash: B0212371604244DFDB01DF94D9C4B2AFFA5FB84324F20C6A9E8494B2C5C37AD846CA61

Function 06536D70 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6f8606f3de983b983d59218942560f8fdf4964cf8c9052d9c962fd366463a8
Instruction ID: fe3dd3a4aa1901bb9757f69bba9231618e2665193bb0c1933302864fcb9a7316
Opcode Fuzzy Hash: 3f6f8606f3de983b983d59218942560f8fdf4964cf8c9052d9c962fd366463a8
Instruction Fuzzy Hash: 27219D30F101299FCF94DAA9E9506AEB7B6EB84710F248829E405DB344DB31ED51CFC4

Function 06533C40 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f8797c0a217554ccc53b3574058d8fa5fdcc31bb54807be994c8ac739dad23
Instruction ID: 3efa6fe075e7ed7d407c68353ecbe30ee3da379e322e5c1b0872af44799f03b1
Opcode Fuzzy Hash: 37f8797c0a217554ccc53b3574058d8fa5fdcc31bb54807be994c8ac739dad23
Instruction Fuzzy Hash: 1A118E31B101384FDF549A69D9146AF73EAAFC8B50F008439D80AE7354EF25DC118BE0

Function 06534280 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7817671c6c23bf1e0b814be372778b1eacaa34867d2a8712e34f7dcc345dee07
Instruction ID: b3bc8da193bc12ceba79fd2c460d88b82c795d0230c5714d9b33a76009618e5a
Opcode Fuzzy Hash: 7817671c6c23bf1e0b814be372778b1eacaa34867d2a8712e34f7dcc345dee07
Instruction Fuzzy Hash: 00012430B101200FDB55CABC8910B2FABD6EBC5B10F14C87AF10ACB395DE25DC424790

Function 0653A357 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0dab19227090ddef1afd0461cb80f5031f60fb47ce1169955120cd382adcee3
Instruction ID: 6812f8daf2c98decf4c3b8fa0468720ceeebaa5f24d1520a38e95787768af09b
Opcode Fuzzy Hash: a0dab19227090ddef1afd0461cb80f5031f60fb47ce1169955120cd382adcee3
Instruction Fuzzy Hash: 1F01D431B106241FDB65DA38D855B6F7BE6EB86B10F00886AF14AC7355EF26ED018BC1

Function 065338F8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c531954a8b9097c89014aeb514c53f01bf7ca3f0672b27817a2e78f977e2e60
Instruction ID: b97a53f2e55ebd177530ed07f427ed9e3855cff9faafe0a1942f6aafeed7f907
Opcode Fuzzy Hash: 1c531954a8b9097c89014aeb514c53f01bf7ca3f0672b27817a2e78f977e2e60
Instruction Fuzzy Hash: B121E0B6D00269EFCB00DF9AD984ACEFBB4FB48710F50812AE518B7240C774A554CFA5

Function 00B0D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256567066.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b0d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6652eeb8aed4b1e6fe96ccaa8552178b570a8723e872266d7c2184c181449fb2
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 23118B75504280DFDB06CF54D5C4B19BFA2FB84314F24C6AAD8494B796C33AE84ACBA2

Function 00B0D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256567066.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b0d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 5d7d8a3ab556b043001d95a77a9aaa4b01a7aeaa2c04eb521434947efe490286
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: DE11DD75504284CFCB11CF50D9C4B16BFA2FB84318F24C6AED8494B6A2C33AD84ACF62

Function 00B0D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256567066.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b0d000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 70781312f0c695d7b364e81d7234f1c631402cd5f6a9fc93625a520730c10450
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 3E11BF76504284CFDB12CF54D5C4B56FFA1FB84324F24C6AADC494B696C33AD81ACBA2

Function 0653FF2B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c570cf21b9396bd2863c3d6fc8b6467d5fcb5ba541b7dc6d6439567a0bc20dc9
Instruction ID: 9c6312560e8a7dcaba9402734c9452419d0a83b165f1cfacdb03e916f9706c75
Opcode Fuzzy Hash: c570cf21b9396bd2863c3d6fc8b6467d5fcb5ba541b7dc6d6439567a0bc20dc9
Instruction Fuzzy Hash: 2B012234A053455FCB91EBB8E8107AEBBF5FB86300F1080BAD904D7257EB348841CBA2

Function 0653EDE9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e399a45626b5f8aeffb4fb0d0df4b82b5ffc50fb6b5243fe701d3071b3a9d83e
Instruction ID: 1a9375cfb516edbd029b54159c68ebf2dec5f9ec25e214ee526dbfb1f43acec1
Opcode Fuzzy Hash: e399a45626b5f8aeffb4fb0d0df4b82b5ffc50fb6b5243fe701d3071b3a9d83e
Instruction Fuzzy Hash: 4301D435B142210FCB659A7D9850B3B67E6EBC5B20F14882AE20AC7351DA25DD024BD5

Function 06533900 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db183b2928c81c07bafcf0cac03a68a0ed2a60b10635b19535a23fa30447d437
Instruction ID: 6b697ce77ea17869cc5ad8ef4ea844619ea2174609dbdd7861a2efee09fb527f
Opcode Fuzzy Hash: db183b2928c81c07bafcf0cac03a68a0ed2a60b10635b19535a23fa30447d437
Instruction Fuzzy Hash: AB11A2B5D01259EFCB00DF9AD884ADEFFB4FB49310F50812AE518A7250C375A554CFA5

Function 06534290 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514d0c5277e292a624aa25fc2a91b2173c03ff05b4b4bf7371fc6d40c4198514
Instruction ID: ae0ed114997149129ad1d57c1d314e5768e8ed3f4897b7187464f294fbf9749a
Opcode Fuzzy Hash: 514d0c5277e292a624aa25fc2a91b2173c03ff05b4b4bf7371fc6d40c4198514
Instruction Fuzzy Hash: 4601D631B101200BDB5899BDD510B2FB3DAEBC8B10F10C839F10AC7344EE22DC424B84

Function 06533C2F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02cafbe1e1d595c57cff73ac87b47b415e23b576c6ae1d0b74fb95c67e405f36
Instruction ID: 0e0b204edc7acf5e83cdbe0e486d728988ec47fe28813eafb760f4b728bccad9
Opcode Fuzzy Hash: 02cafbe1e1d595c57cff73ac87b47b415e23b576c6ae1d0b74fb95c67e405f36
Instruction Fuzzy Hash: BE01A231B100384BDFA49A69DD146EF33ABAFC8A40F04853AD90AE7284EF60CC1647D5

Function 0653EDF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9461ef6b6068701c1ad6f44d8190b4ed14a8bb974e09cf452e2da290e711bc83
Instruction ID: 20cfba34b8cf36056d2de83da51b9f8dfb66f764da5366de960528181ba7ca48
Opcode Fuzzy Hash: 9461ef6b6068701c1ad6f44d8190b4ed14a8bb974e09cf452e2da290e711bc83
Instruction Fuzzy Hash: 19018131B102210BCB65997D9451B2F63DAE7C9B20F10883AE60AC7344EE26DC024BD5

Function 0653A368 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade0149f1280d9ce4bab02e594735052fccd94b74590028d038d90823b3d4ae1
Instruction ID: ee70572d7ec016e0be733b0f77488c2c6c2b64bc3772fd0fa60b6385de33cbc7
Opcode Fuzzy Hash: ade0149f1280d9ce4bab02e594735052fccd94b74590028d038d90823b3d4ae1
Instruction Fuzzy Hash: AA013C31B105244FDB65AA7DD554B2EB3D6EB8AB50F10C829E54AC7354EE26ED018BC0

Function 00AFD8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256234823.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_afd000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e759cdb9b513dba306809d0e43a8c3eaf404e658332f533e4f2924da40935a7
Instruction ID: ec8a22c7b8c8cf764ec7438e0f2bc3a3b7c844e40d2878c2d6cbbc1ec66c9b20
Opcode Fuzzy Hash: 9e759cdb9b513dba306809d0e43a8c3eaf404e658332f533e4f2924da40935a7
Instruction Fuzzy Hash: 0501FC310083489AE7124BA5CDC4777BFA9DF41364F18C46AFE094A186C275D840C671

Function 0653C840 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d0ce6c88f06bee6dfcbb3b28c984f6fb92e5f7e39708761abe8c4400f9b17f
Instruction ID: 540a06302117568eefd86438c4fcdc3de5b2c916ff9ed60c3d7c6bc19c987a74
Opcode Fuzzy Hash: 77d0ce6c88f06bee6dfcbb3b28c984f6fb92e5f7e39708761abe8c4400f9b17f
Instruction Fuzzy Hash: C301C831F212289BCF58EA79E841A9DB775F784710F108539E905F7345DB32A9058BC0

Function 00AFD8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4256234823.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_afd000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb89ea11a1e7eb850518e61562b4ebec396aee4c4616ead60d966e630359eecc
Instruction ID: fe5b6cbc02c9a370f7f79a56e1813ee556612b9b0994e703ac3dc1fd81387ce5
Opcode Fuzzy Hash: fb89ea11a1e7eb850518e61562b4ebec396aee4c4616ead60d966e630359eecc
Instruction Fuzzy Hash: D1F0C272008344AAE7118F56CCC4B62FFA8EB51324F18C45AFE484A286C2B99840CA70

Function 0653FF48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb1c254b5a95f877997403188de2cd931dc25fd8211f704866ce0d4a1493612
Instruction ID: 0aa75f3b86a866ef59d37da69ffaa310d96948d6c38bebf746cafdabc3b98ef9
Opcode Fuzzy Hash: 0fb1c254b5a95f877997403188de2cd931dc25fd8211f704866ce0d4a1493612
Instruction Fuzzy Hash: 8EF05874A102098FDB80EFB8855022EB7F6BB89200F10817D8909E7359EB748941CBA2

Function 065364C9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303c37b19de06342e1dc7dde7a94c4e9b1aa19ea255720ff5cb814bd082c2383
Instruction ID: edc9b1dbc141270cc5d30e9da3d9ead42db988a024fba2f4a54db87597858017
Opcode Fuzzy Hash: 303c37b19de06342e1dc7dde7a94c4e9b1aa19ea255720ff5cb814bd082c2383
Instruction Fuzzy Hash: D2E06830E1929A7BDF60CB70D994B8B7BADF702204F1088E8E004CB102F176CE0087A1

Non-executed Functions

Function 065376F8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$kq, xrefs: 06537C5A
$kq, xrefs: 065377F4
$kq, xrefs: 06537825
$kq, xrefs: 065377E8
$kq, xrefs: 06537C50
$kq, xrefs: 06537C44
$kq, xrefs: 06537819
$kq, xrefs: 06537C66
$kq, xrefs: 06537BA5
$kq, xrefs: 06537BB1

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: ab60bf35a978501dd7f1babc4ffaa7c51149ccef158519098e7dec4a3f67f9a2
Instruction ID: c2d3dbdf9ec718c107ebde2ebbe96edbaf6308c8fc561a30098a3580248cc181
Opcode Fuzzy Hash: ab60bf35a978501dd7f1babc4ffaa7c51149ccef158519098e7dec4a3f67f9a2
Instruction Fuzzy Hash: B9123F70E01229CFDB64EF65C994A9EB7F2BF88700F208569D409AB365DB349D85CF84

Function 0653A990 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$kq, xrefs: 0653AB0C
$kq, xrefs: 0653AB18
$kq, xrefs: 0653AB42
$kq, xrefs: 0653AB4E
$kq, xrefs: 0653AAED
$kq, xrefs: 0653AA86
$kq, xrefs: 0653AAE1
$kq, xrefs: 0653AA92

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: 9602b2b89fd5de8cd2e59ff94a7aa7dd2fe2bece8f4d68e3e9f8377460d31dc2
Instruction ID: f28b032008e8c0a333f0a5bdf6de97c16e21bb53356e87257769138f82336758
Opcode Fuzzy Hash: 9602b2b89fd5de8cd2e59ff94a7aa7dd2fe2bece8f4d68e3e9f8377460d31dc2
Instruction Fuzzy Hash: 4D919F30A1021DDFEB68EF64D654BAEB7F2BF84700F208429E445AB395DB799C45CB90

Function 065370F8 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$kq, xrefs: 06537600
$kq, xrefs: 06537434
$kq, xrefs: 065373DA
$kq, xrefs: 0653760C
$kq, xrefs: 06537594
$kq, xrefs: 06537440

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 83f5511f743eb7a6487685cc2bae958181c5405c5b329b4d0a6614c2948bbbb8
Instruction ID: e083ed9a6e979182b95fadb9fd32d77c20a77297a5c80db448a354c93df2ed90
Opcode Fuzzy Hash: 83f5511f743eb7a6487685cc2bae958181c5405c5b329b4d0a6614c2948bbbb8
Instruction Fuzzy Hash: 61F15070A01218CFDB58EF68C554A6EB7F2BF88700F208569D409AB369CB35EC46CB54

Function 06538428 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$kq, xrefs: 06538682
$kq, xrefs: 065386F3
$kq, xrefs: 0653868E
$kq, xrefs: 065386E7

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 3a05feb7864693d76c0e8a6b977a45bf474e994b4fbb10831b44fb487d046054
Instruction ID: 300c0bcf3b71aab852d4224d7031cc10ecca09c5493935c02e2284d462e5fc73
Opcode Fuzzy Hash: 3a05feb7864693d76c0e8a6b977a45bf474e994b4fbb10831b44fb487d046054
Instruction Fuzzy Hash: 0BB14C30A11219CFDB68EF65C5446AEB7F2BF84700F248869E409AB395DB75DC86CB90

Function 06538840 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$kq, xrefs: 065388BF
LRkq, xrefs: 06538982
LRkq, xrefs: 06538933
$kq, xrefs: 065388CB

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: LRkq$LRkq$$kq$$kq
API String ID: 0-2392252538
Opcode ID: afd2f19f2c666bf965ce198fc4e8f838886a367da6982cbb291bd648f59f5ca4
Instruction ID: 0901304895e0dc385176d9d884b2eb20cbcced817ec3c240712208feb60ea654
Opcode Fuzzy Hash: afd2f19f2c666bf965ce198fc4e8f838886a367da6982cbb291bd648f59f5ca4
Instruction Fuzzy Hash: 7E51B031B002158FDB58EF68D944A6AB7E2FF88710F148969F4169B3A9DB35EC44CB90

Function 0653AD18 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$kq, xrefs: 0653AEF4
$kq, xrefs: 0653AE49
$kq, xrefs: 0653AE9C
$kq, xrefs: 0653AECB

Memory Dump Source

Source File: 00000009.00000002.4279098124.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6530000_DHL Delivery Invoice.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: ad2e765f920722acc31df7a60d7ce2377f8cafdb67796175db34ee40c4ead88d
Instruction ID: ab7862ec9d8e1f967520768ae7d90af456795503abf2d5e99a987fc169fd2a42
Opcode Fuzzy Hash: ad2e765f920722acc31df7a60d7ce2377f8cafdb67796175db34ee40c4ead88d
Instruction Fuzzy Hash: CE51AF34E102158FCFA4EB64D580AAEB3B2FF84711F208969E85AAB355DB34DC45CF90

Analysis Process: LIWBHGsz.exePID: 2852, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	222
Total number of Limit Nodes:	19

Executed Functions

Function 02E60CC7 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02E60F06

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7d73dfc6526db20b9e740a87f264e953c374b1c96e673dc9e9fe6b4b28a31c04
Instruction ID: 620d9592448f5b587ffec4b91ad122f4ee66e7ef6ac96ea164801a7382800e99
Opcode Fuzzy Hash: 7d73dfc6526db20b9e740a87f264e953c374b1c96e673dc9e9fe6b4b28a31c04
Instruction Fuzzy Hash: E491AE71D40229DFDF10CFA8C844BEEBBB2BF48354F0495A9E809A7254DB759981CF91

Function 02E60CD0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02E60F06

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 85575ffd09942816d01a96f425b4ad9c668d4a9882de08e6d6202941ae625a9f
Instruction ID: 30aa7900cd971964f4f9360b44f6b703907f326ba94773f37047f100e3fa5a6d
Opcode Fuzzy Hash: 85575ffd09942816d01a96f425b4ad9c668d4a9882de08e6d6202941ae625a9f
Instruction Fuzzy Hash: 52919D71D40229DFDF10CFA8C844BEEBBB2BF48314F1495A9E809A7280DB759981CF91

Function 0304B3F5 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 0304B4B1

Memory Dump Source

Source File: 0000000A.00000002.1877233416.0000000003040000.00000040.00000800.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3040000_LIWBHGsz.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4ddf8794dbabaae67a849d2fd48dc74c89fc9d56d40a235474a9e3a4874cd02a
Instruction ID: b6535e9e0e50fc923f6fa5a38a850b613e452b40714db92871dc4a7768d0cff9
Opcode Fuzzy Hash: 4ddf8794dbabaae67a849d2fd48dc74c89fc9d56d40a235474a9e3a4874cd02a
Instruction Fuzzy Hash: 3F41F0B0C01619CFDB24DFA9C944B9DFBF5BF48304F24816AD408AB255DB75A986CF90

Function 03049FBC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 0304B4B1

Memory Dump Source

Source File: 0000000A.00000002.1877233416.0000000003040000.00000040.00000800.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3040000_LIWBHGsz.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d38922f7ce6c4981899f7a18cccb084d2b738fcf3009e88d37d20b44e9c45aa6
Instruction ID: 99f38c0e5b9780db9ccfc4cd74ca109c220c5280bb67f490ee506de249579f35
Opcode Fuzzy Hash: d38922f7ce6c4981899f7a18cccb084d2b738fcf3009e88d37d20b44e9c45aa6
Instruction Fuzzy Hash: E741EDB0C0061DCADB24DFA9D844B8EBBF5BF48304F24806AD408AB255DBB5A985CF90

Function 07F68368 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1883196627.0000000007F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f60000_LIWBHGsz.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: febd43c3846e67b4119f8d51ba037683f975c4cbb4d8696774de6df5c8b1d302
Instruction ID: 60e602d5a52408190ee3b8b01796fe998902b8f8ba0a502ce8ee46094565a904
Opcode Fuzzy Hash: febd43c3846e67b4119f8d51ba037683f975c4cbb4d8696774de6df5c8b1d302
Instruction Fuzzy Hash: 2C317AB19043999FCB12DFA9D844AEEBFF4EF09310F18805AF954AB221C3359950DFA1

Function 07F66CF9 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,07F66CE5,?,?), ref: 07F66D97

Memory Dump Source

Source File: 0000000A.00000002.1883196627.0000000007F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f60000_LIWBHGsz.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: d615a12f5cd50401f6e7541e5a616c05e989ab1c5b96301d11e5ae05e183a162
Instruction ID: 9ba5c7c5b569f2ee9ca912dba3e0557768f3b0efb021ba74a0f0349662da54ee
Opcode Fuzzy Hash: d615a12f5cd50401f6e7541e5a616c05e989ab1c5b96301d11e5ae05e183a162
Instruction Fuzzy Hash: 8C31D2B5D002499FDB10DF9AD884ADEFBF4FF48320F18842AE919A7610D775A954CFA0

Function 07F65754 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,07F66CE5,?,?), ref: 07F66D97

Memory Dump Source

Source File: 0000000A.00000002.1883196627.0000000007F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f60000_LIWBHGsz.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 7a7736d3de378fd809fdaf5b02e6cecb2c31e19375025f0a40bc6f957e5023c1
Instruction ID: cb5973e458100c4df265ed95798ccc60a2cd4b982b91c9282b9fd882635db492
Opcode Fuzzy Hash: 7a7736d3de378fd809fdaf5b02e6cecb2c31e19375025f0a40bc6f957e5023c1
Instruction Fuzzy Hash: 2331C3B5D00249AFDB10DF9AD884ADEFBF4FB48310F14842AE919E7210D774A954CFA4

Function 02E60A45 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02E60AD8

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ec137c1bfebba705380e542f55cf2c9fcdf123d22aa46cff13968b0990f30d3c
Instruction ID: 528820dcc7bce4b859b8690951cce9d06aee3f11db3183d0b184d3638d005702
Opcode Fuzzy Hash: ec137c1bfebba705380e542f55cf2c9fcdf123d22aa46cff13968b0990f30d3c
Instruction Fuzzy Hash: 8C2177B19003199FCF00DFA9C984BEEBBF5FF48314F10842AE958A7240C778A940CBA0

Function 02E60A48 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02E60AD8

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4764b46ccce1c68f92f1103ae29b25a191e7cdac0518c9c392a1e68757a5c311
Instruction ID: 6acc5581f017f2f798c48774b54be84c85a59fd07408de123d7001c9cf1a42cd
Opcode Fuzzy Hash: 4764b46ccce1c68f92f1103ae29b25a191e7cdac0518c9c392a1e68757a5c311
Instruction Fuzzy Hash: 832157B19003599FCF10DFA9C985BEEBBF5FF48314F108429E959A7250C778A944CBA0

Function 02E60470 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02E604F6

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3bec345dc21e63a490413780b84cac3f89196d7faa9a03b87bd3974b7dd47d81
Instruction ID: 3e6d109ca21dd6241c8bf08f715f0de128a2517f4cdab26908780435e878672a
Opcode Fuzzy Hash: 3bec345dc21e63a490413780b84cac3f89196d7faa9a03b87bd3974b7dd47d81
Instruction Fuzzy Hash: 742157B19002598FDB10DFAAC5857EEBFF4AB88324F14C429D459A7251CB78A944CFA0

Function 02E60B34 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02E60BB8

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b4c7147fd5b3bbe25c6231f7c75d6c035369855e9c930cbf3cc6b8cec7b8df23
Instruction ID: 142462698dc0274700e56fb1ff995877e04dc5a2931432b47d994ae5227c49d9
Opcode Fuzzy Hash: b4c7147fd5b3bbe25c6231f7c75d6c035369855e9c930cbf3cc6b8cec7b8df23
Instruction Fuzzy Hash: 052148B18003599FCB10DFAAC985AEEBBF5FF48324F108429E559A7250D7389540CBA0

Function 02E60B38 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02E60BB8

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 05d5db0708a87247c66f87347e7cef2fd797263609a7f0e783603d7f245bdee6
Instruction ID: b5ccb66c71946428f39d7264e540935fd522a57b349a1ae899b3ec645901f03b
Opcode Fuzzy Hash: 05d5db0708a87247c66f87347e7cef2fd797263609a7f0e783603d7f245bdee6
Instruction Fuzzy Hash: E82128B19003599FCB10DFAAC985AEEBBF5FF48324F108429E559A7250D7389544CBA4

Function 02E60478 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02E604F6

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 25621056725cb9800f6a348e606cae4952f9751ea2b5d30812f792505f160ec8
Instruction ID: b7fb5424aca70d080f623a6feee566bc85a0f90e7c09bcba6d1fab8ab03429f6
Opcode Fuzzy Hash: 25621056725cb9800f6a348e606cae4952f9751ea2b5d30812f792505f160ec8
Instruction Fuzzy Hash: 602118719003198FDB10DFAAC5857EEBBF4EF48364F14C429D459A7241C778A944CFA4

Function 07F67F54 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,07F68382,?,?,?,?,?), ref: 07F68427

Memory Dump Source

Source File: 0000000A.00000002.1883196627.0000000007F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7f60000_LIWBHGsz.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 572717479a80ee652f6a5c9b03d41e2c15071723366ea84ab093ac2a4db801be
Instruction ID: eb10ad44e07951feb042a469b4f182e89195a83ee519d9b1913dc6073d71944f
Opcode Fuzzy Hash: 572717479a80ee652f6a5c9b03d41e2c15071723366ea84ab093ac2a4db801be
Instruction Fuzzy Hash: E41179B1804349DFCB10DF9AD888BDEBFF8EB48360F14841AE954A7210C335A950CFA4

Function 02E60980 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02E609F6

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 73578e5bc696c93b1c3f565c738e5a73044f42f026141d5a1b3c66ea4409cf97
Instruction ID: bf29db6d0cae8a61f2a03af6ac23344cd6006f4629e47b9ad52cd1203c636df7
Opcode Fuzzy Hash: 73578e5bc696c93b1c3f565c738e5a73044f42f026141d5a1b3c66ea4409cf97
Instruction Fuzzy Hash: BC1126729002499FCB10DFAAC945BEFBFF5EB88324F108819E559A7250C775A944CFA4

Function 02E60988 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02E609F6

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b149557d136fed973e3969358a78099a5e919381c152c4b3ba6a00eaeb7b50e
Instruction ID: 8c19cf39a71b0f90d8a5681f5c405a6aab6a680e65cb5e9ced0ea355264d23a7
Opcode Fuzzy Hash: 9b149557d136fed973e3969358a78099a5e919381c152c4b3ba6a00eaeb7b50e
Instruction Fuzzy Hash: F41134729002499FCB10DFAAC945BEFBFF5EF88324F208819E559A7250C775A944CFA0

Function 086AFE30 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000009), ref: 086AFE9A

Memory Dump Source

Source File: 0000000A.00000002.1883398187.00000000086A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_86a0000_LIWBHGsz.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 43bf883aaf4943a82ffd6d2704ea255a1a5762cc11282b132f65be8897cbe68f
Instruction ID: 85ff576872bfd97034054afda02f3b099b3aea737117fcdccb422752ea82be72
Opcode Fuzzy Hash: 43bf883aaf4943a82ffd6d2704ea255a1a5762cc11282b132f65be8897cbe68f
Instruction Fuzzy Hash: 02115BB19003498FCB10DFAAD4457EEFBF5AB88324F208819D459A7251CB35A944CFA5

Function 086AFE38 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000009), ref: 086AFE9A

Memory Dump Source

Source File: 0000000A.00000002.1883398187.00000000086A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_86a0000_LIWBHGsz.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: acc3f4fa53cd877999e50d70919c3d639932dfef4937330ec2d1b89f3afe0ba9
Instruction ID: 1f26c11c684d71c6422367af7bf28f275ef283ab828dd46d5253cca745b629a4
Opcode Fuzzy Hash: acc3f4fa53cd877999e50d70919c3d639932dfef4937330ec2d1b89f3afe0ba9
Instruction Fuzzy Hash: 39116AB1D003488FCB10DFAAC4447EEFBF4EB88320F208819C459A7250CB34A944CFA4

Function 02E63D68 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02E63DCD

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1ebddd2d2acb2334fb006386cd288fa0638082fffa8542402f9354291ba97db9
Instruction ID: 4a551a282388e37479ca4d6ca258ade9f4e48e518926ab5dfe7544263eeb078d
Opcode Fuzzy Hash: 1ebddd2d2acb2334fb006386cd288fa0638082fffa8542402f9354291ba97db9
Instruction Fuzzy Hash: B611F2B6800249CFDB10DF99D989BEEBFF8EB49314F10845AE559A7210C379A584CFA0

Function 02E63D70 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02E63DCD

Memory Dump Source

Source File: 0000000A.00000002.1877038784.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e60000_LIWBHGsz.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b898c1c3f9c158a5b7ceb3085dc32ee3a9aa69fed39ad35f8c74ac328c459f29
Instruction ID: 63b849c829c8fc61f745675eaffcae5ac68b73ff9a827b0b86a572120aae084f
Opcode Fuzzy Hash: b898c1c3f9c158a5b7ceb3085dc32ee3a9aa69fed39ad35f8c74ac328c459f29
Instruction Fuzzy Hash: 9B1103B58003489FCB10DF9AD989BDEBBF8EB48324F10845AE559A7210C375A544CFA1

Function 0150D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874119269.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_150d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ac60ce7ce078914573dd69aeb64595cd7bd5edc5bc1918a5c420f8993a6690
Instruction ID: 779353659703679729aef92d6471734af191288d2db5ca2db999c4f3ad635138
Opcode Fuzzy Hash: e2ac60ce7ce078914573dd69aeb64595cd7bd5edc5bc1918a5c420f8993a6690
Instruction Fuzzy Hash: AC214871100200DFDB02DFC8C9C0B6ABFB5FB84324F20C569E9090F296C376E446C6A2

Function 0150D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874119269.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_150d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32f767978c4360eed8ab87c4acb4ed57dd1fca74fce8189309993daa47adadc
Instruction ID: 64afad6fb5df651e16be02c71bee94445d10ca4536b3b981404d1b9d0ee026b2
Opcode Fuzzy Hash: d32f767978c4360eed8ab87c4acb4ed57dd1fca74fce8189309993daa47adadc
Instruction Fuzzy Hash: 3A21BD71504240DFDB06DFD8D980B2ABFB5FB88318F24C569ED094E296C336D456CAA2

Function 0151D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874208658.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_151d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f581554570de0471ef01195e76dfd5a31c0a297c456b717d97a81dcdaa8ef3
Instruction ID: 1bd78b09d19514bdd2843e8faf18d8df5f2af7d5b26cb8079fe6aa19348a6937
Opcode Fuzzy Hash: 21f581554570de0471ef01195e76dfd5a31c0a297c456b717d97a81dcdaa8ef3
Instruction Fuzzy Hash: 2C210075604200DFEB16DF58D988B2ABBB5FB84314F20C96DD80A4F25AD33AD846CA61

Function 0151D39C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874208658.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_151d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae64c2e5d0df206a3be6e67e77eeefaa4e29d4893277a70763c5e1f072d7c21
Instruction ID: cac7f7a5f1b80823ddb78b2344014048ebecc4826160e4007edd03b482824216
Opcode Fuzzy Hash: dae64c2e5d0df206a3be6e67e77eeefaa4e29d4893277a70763c5e1f072d7c21
Instruction Fuzzy Hash: FE214975540200DFEB02DF58D5C8B2ABFB5FB84314F20C96DD9094F29AC3BAE446CA61

Function 0151D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874208658.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_151d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822f00769bec24d554850ac28a69ab65d997d6e6418a2b1116f267c136e86994
Instruction ID: ba957e1f3ee2e0b2619052d3bc78724892f7dfb11fb109b3d0f622edb7b259e4
Opcode Fuzzy Hash: 822f00769bec24d554850ac28a69ab65d997d6e6418a2b1116f267c136e86994
Instruction Fuzzy Hash: 67219F755093808FDB03CF24D994B15BF71FB46214F28C5EAD8498F2A7C33A984ACB62

Function 0150D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874119269.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_150d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 3da0e26c2be68106e1f42d4e329715da3c2b89e88262f60e298d1f010beb1cba
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 0811DF72404240CFDB02CF84D5C4B5ABF71FB94324F24C2A9D9090F256C33AE45ACBA1

Function 0150D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874119269.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_150d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 56788db494a8cfcca4faddb85ecd648d2dde0e798e8478e01f963262c16fc2be
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1F119D76504280CFDB16CF94D5C4B1ABF71FB88218F24C6A9DD490F696C33AD45ACBA1

Function 0151D397 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1874208658.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_151d000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 8771325a1a6c76f63740dee260c059c1cc7ec9f6e32a252996170a0e793e4381
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5D11BE75544280DFDB02CF58D5C8B59BF71FB84214F24C6A9D8494F256C3BAE44ACB51

Analysis Process: LIWBHGsz.exePID: 7436, Parent PID: 2852COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	6

Executed Functions

Function 06CE30E0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06CE3814
$kq, xrefs: 06CE3808
$kq, xrefs: 06CE37DF
$kq, xrefs: 06CE3838
$kq, xrefs: 06CE382C
$kq, xrefs: 06CE37EB

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 5fad17fdd0390899952a221e50d31788e3e04456ccbfe02a502d840bdd09743c
Instruction ID: 3d8731af9faf5287ff707ad8131bbde83c42b392e637a6525f1a1709d7039e25
Opcode Fuzzy Hash: 5fad17fdd0390899952a221e50d31788e3e04456ccbfe02a502d840bdd09743c
Instruction Fuzzy Hash: 58322F31E10759CFDB14EF65D99459DB7B2FFC9300F20869AD409AB264EB30AD85CB90

Function 06CE7DD8 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06CE8115
$kq, xrefs: 06CE8121

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 4304002d9b089e6f937beb96d86f12251cc4ed420f2e3d4c866b0e055c2c0254
Instruction ID: c5050a45c20bd6c57a1769210daabe11acebaf66eea17ec66f8c906bb6c2c0ba
Opcode Fuzzy Hash: 4304002d9b089e6f937beb96d86f12251cc4ed420f2e3d4c866b0e055c2c0254
Instruction Fuzzy Hash: 5102C030B012059FDB54DF69D594AAEB7F2FF84300F148929E5169B3A8DB35ED82CB90

Function 06CE2408 Relevance: 1.0, Instructions: 1006COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787d85255b8ef1ae16a6ab09d5a17ae08eb4ae368ae54aa0a9df4df8d47c12a8
Instruction ID: eed13da388462570b816d48fc3aaabc6380cb6f6528fc146b1bf2e000812258b
Opcode Fuzzy Hash: 787d85255b8ef1ae16a6ab09d5a17ae08eb4ae368ae54aa0a9df4df8d47c12a8
Instruction Fuzzy Hash: 7E925534E002448FDBA4DF68C584B5DBBF6FB45310F5484AAD44AAB365DB39EE85CB80

Function 06CE6648 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ec93251bc325cd86b1ff4afb4077ab74e490f7ad869152e47b6ee0d8239073
Instruction ID: e25ee1e091df7d0e8da1af17543cda494e1aceeb5c46c64ec4603ffbfd2aaa4d
Opcode Fuzzy Hash: 36ec93251bc325cd86b1ff4afb4077ab74e490f7ad869152e47b6ee0d8239073
Instruction Fuzzy Hash: 58629D34B102058FDB54DB6AD584BADBBF2EB98310F248469E406DB394DB35EE85CB90

Function 06CEC1E8 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69260616ef153a1f5e290515a62ae8d7d5279cddfa226ee753896e5b4c594b03
Instruction ID: 9cce0af3224d39362138cf035762a8fe8a89386c7c54431434c5e95eae59061d
Opcode Fuzzy Hash: 69260616ef153a1f5e290515a62ae8d7d5279cddfa226ee753896e5b4c594b03
Instruction Fuzzy Hash: 18328030B002058FDF54DB69D994BAEBBB2FB88310F108529E515EB395DB38DD81CB90

Function 06CE5628 Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39390b403d557549ff776144f8109e10c70d57442b9efa4e76b8c231b86bc0cf
Instruction ID: e90474186e75cae984df53defee758c27b3613daf75e167b6b55c415e41ba240
Opcode Fuzzy Hash: 39390b403d557549ff776144f8109e10c70d57442b9efa4e76b8c231b86bc0cf
Instruction Fuzzy Hash: 1B120275F002058FDB60DB64D9806AEB7B2FF84324F64842ED956DB394DA36ED81CB90

Function 06CEB283 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2b80beee33cc10641aa5fa2b515d02685de73430fbe066826cfcb89218a766
Instruction ID: 99919221a574a017b85290fcd9000e11dcd9733bc7bdb6e51bb6a051f21e0ba0
Opcode Fuzzy Hash: 6a2b80beee33cc10641aa5fa2b515d02685de73430fbe066826cfcb89218a766
Instruction Fuzzy Hash: 70227E30E102098FDF64DB68D6807BEB7B6FB49310F24852AE405EB395DA35DD81CB91

Function 06CEB6A0 Relevance: 8.0, Strings: 6, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06CEBC0D
$kq, xrefs: 06CEBC35
$kq, xrefs: 06CEBC41
$kq, xrefs: 06CEBC01
$kq, xrefs: 06CEBC75
$kq, xrefs: 06CEBC69

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 906a968808cbe5a2624390f335fc01b5f853bc0beb19ece1b2f0c97d587b4ae7
Instruction ID: c9a83d7884777f03e4a00aba869db14d420380c2afb36d6da839653b9cc748b8
Opcode Fuzzy Hash: 906a968808cbe5a2624390f335fc01b5f853bc0beb19ece1b2f0c97d587b4ae7
Instruction Fuzzy Hash: 59027B30E1020A8FDFA4DF69D6806ADB7B2FB45310F24856AD405EB395DB34EE85CB91

Function 06CE91A0 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06CE9210
$kq, xrefs: 06CE921C
$kq, xrefs: 06CE9257
$kq, xrefs: 06CE924B

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: fda9fdf882054eb4b51595caee433808155bc049090fa690d041770628c36c1e
Instruction ID: 5dd5b510541b53928bfca2a2c3050dd432ed6686d84c1ad65ecbc4fe500e2e9d
Opcode Fuzzy Hash: fda9fdf882054eb4b51595caee433808155bc049090fa690d041770628c36c1e
Instruction Fuzzy Hash: 6C913130F1020A8FDF64DF66D9507AEB7F6EF84240F108569D40AAB398EA74ED41CB90

Function 06CECFA8 Relevance: 4.5, Strings: 3, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06CED39B
$kq, xrefs: 06CED3AF
$kq, xrefs: 06CED3A3

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq
API String ID: 0-2086306503
Opcode ID: 3eb350d2b244400fb6731e321b8d08f16852a8eb162bbf88ed2b856f49e45fad
Instruction ID: 776a095d3b7a059407efa3a89ae1b113e6912399e251d8738c7c97af0d91997a
Opcode Fuzzy Hash: 3eb350d2b244400fb6731e321b8d08f16852a8eb162bbf88ed2b856f49e45fad
Instruction Fuzzy Hash: 27624070A102068FCB55DF69D690A5EB7B2FF84300B208A69D4169F369DB75FD86CB80

Function 06CE4BF0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Opq, xrefs: 06CE4DA7
fpq, xrefs: 06CE52FD
XPpq, xrefs: 06CE4D1D

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: 173458369c9fa012948c78f59aa059b83183deeeb745c1a6eebb4c7c539c466d
Instruction ID: fb4231fb4a7bf12a7efa06737da2fef4085abadbebfd1849b14649e908544cc6
Opcode Fuzzy Hash: 173458369c9fa012948c78f59aa059b83183deeeb745c1a6eebb4c7c539c466d
Instruction Fuzzy Hash: 3E615071F002099FEB549FA5C854BAEBBF6FB88700F20852ED606AB394DA754D45CB90

Function 06CE9193 Relevance: 2.7, Strings: 2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06CE9210
$kq, xrefs: 06CE924B

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: af0a597b756bb6391e40aa81ff28dbcce0d040401ce4d4fbd1f6722adca2a7d5
Instruction ID: ae04bf3f16610fadc95a6bd6befe9dd01edb1217ae3027350b8b3e5e2136c617
Opcode Fuzzy Hash: af0a597b756bb6391e40aa81ff28dbcce0d040401ce4d4fbd1f6722adca2a7d5
Instruction Fuzzy Hash: 02515030B001058FDF54EF7AD994B6EB7F6EB88640F108569D80ADB398EA35ED41CB90

Function 0309EB30 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4258817348.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3090000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456a7a631915475b48cf28f8ab2491284422def1595ef8ad7f515596beaf629f
Instruction ID: 2aebbfac2e9342532e588bccfc196b488561862f000a9d5f78535958d64978e4
Opcode Fuzzy Hash: 456a7a631915475b48cf28f8ab2491284422def1595ef8ad7f515596beaf629f
Instruction Fuzzy Hash: A2412072E013999FDB14DFA9D8042EEBFF1AF99310F14866AD504A7391DB349845CBA0

Function 0309EC18 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0309EC7F

Memory Dump Source

Source File: 0000000E.00000002.4258817348.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3090000_LIWBHGsz.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7cb3aa8e80d9b7f5b2d44e90a5124f9d0acfd5e4cf448536726edd718e1843af
Instruction ID: 2c4f02ab013173247871cbb30d9cfc9770e10ccb361c7b5fc082d884c92b5a3f
Opcode Fuzzy Hash: 7cb3aa8e80d9b7f5b2d44e90a5124f9d0acfd5e4cf448536726edd718e1843af
Instruction Fuzzy Hash: 4011F0B2C00669DBDB10DF9AC544BDEFBF4AF48320F14816AD858A7251D378A944CFA5

Function 06CE4BE0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

XPpq, xrefs: 06CE4D1D

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: XPpq
API String ID: 0-1266478781
Opcode ID: bc3571a126e1c16b2e903a161446dc4639a998df3227f23c1c162940b8400067
Instruction ID: 836b4e7ec9ab745b13401b43500d29cfb0a2fbf4ae10b4c5d79480529e7332d6
Opcode Fuzzy Hash: bc3571a126e1c16b2e903a161446dc4639a998df3227f23c1c162940b8400067
Instruction Fuzzy Hash: F1415174E002099FDB549FB5C814BAEBBF6EF98700F20852ED105AB3A5DA758C45CB91

Function 06CEDB15 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

PHkq, xrefs: 06CEDC71

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 03701854dee1b0f25316014c4e98986e20444bf5559ef414c1a3113a86f1fc20
Instruction ID: 59f438680a6a9cc1fabfd604fbbe62c19c177d570fbe71437615e38c9d6ce078
Opcode Fuzzy Hash: 03701854dee1b0f25316014c4e98986e20444bf5559ef414c1a3113a86f1fc20
Instruction Fuzzy Hash: 9341BF70E006099FDB64DF65C55069EBBB6FF85340F20492EE412EB340EB74E982CB90

Function 06CE2290 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHkq, xrefs: 06CE23CB

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: a5f8c5380bbb1a00f7c4aacf8e3efce87c11bc23777df9cc6af8f55516d7a419
Instruction ID: cb8d2d21cb7af11d66405b2806a885bc6e09eca39a887f177388c1d856209b5a
Opcode Fuzzy Hash: a5f8c5380bbb1a00f7c4aacf8e3efce87c11bc23777df9cc6af8f55516d7a419
Instruction Fuzzy Hash: BD31E230B002058FCB54AB35D55476F7AFABB89710F24882DD406DB394DE39DE86CB91

Function 06CE6248 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2192096e957ae88c685be9c3788e80c665ede1ff3ad5adbea3335a22e8655c0c
Instruction ID: a8faac576129ee009d19f5414c22adc960d801a696c57f370a59f75eb05c2d2e
Opcode Fuzzy Hash: 2192096e957ae88c685be9c3788e80c665ede1ff3ad5adbea3335a22e8655c0c
Instruction Fuzzy Hash: 9561C3B2F101114BDF519A7EC88466EAAEBEFE4620B154039E80ADB379DE65DD0287C1

Function 06CE4321 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f5ae791935f61c9e99997fa8873582bda7d18a751cd14c821c26e5633d03e8
Instruction ID: e09effa99c3a3449d1762829c839d0ca2071db53e4c56d0fe8f1598bb99971f9
Opcode Fuzzy Hash: 67f5ae791935f61c9e99997fa8873582bda7d18a751cd14c821c26e5633d03e8
Instruction Fuzzy Hash: 68814E34F002058FDF58DFA9D5946AEB7F6EB88310F208529E50ADB395EB34DD428B91

Function 06CE4640 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e161d220dfb748230d538f91dd63181a2f592dc36abbef09b59d47bbb45a18aa
Instruction ID: 8c51b13073b9e43b1df39f9d61ce1c9b7e5aa6ac13beb69a9d6dabe2dc38411d
Opcode Fuzzy Hash: e161d220dfb748230d538f91dd63181a2f592dc36abbef09b59d47bbb45a18aa
Instruction Fuzzy Hash: 92914A30E106198FDF64DF68C850B9DBBB1FF89300F20859AD549EB395DB70AA85CB90

Function 06CEAF78 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78973994921c380ee291cfc60efa735c300b835ff477095e6418d9e3fa3c95d2
Instruction ID: ceaa3de504bad7d86837340564fa1a7e02caf91ff38d9c7cf353578fd145260c
Opcode Fuzzy Hash: 78973994921c380ee291cfc60efa735c300b835ff477095e6418d9e3fa3c95d2
Instruction Fuzzy Hash: A8715E71E0021A8FDB55DFAAD6446AEB7B2FF85300F108529D409AB368DB74DD86CB90

Function 06CE4658 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c90924e7df345ee557da9b8b2e387a5c732c5a5eec25ede2d2ef41bee314dd
Instruction ID: 581253e66790b237a70106c9690c495d5b52e953044cad25226257fc633e3baf
Opcode Fuzzy Hash: e5c90924e7df345ee557da9b8b2e387a5c732c5a5eec25ede2d2ef41bee314dd
Instruction Fuzzy Hash: FC914B30E102198BDF64DF68C880B9DB7B1FF89300F20859AD549BB395DB70AA85CF90

Function 06CEEB68 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e042a9e0615a2dd57e17e74554f2aa5a65efb58ae8289720eac7ef37fcbc7a
Instruction ID: 5a0648b1658380c4fba4d2d66bc769899a31119ce7bab8a0da5d5c314a452328
Opcode Fuzzy Hash: 82e042a9e0615a2dd57e17e74554f2aa5a65efb58ae8289720eac7ef37fcbc7a
Instruction Fuzzy Hash: E1713974E012099FDB54DFA9D980A9EBBF6FF88340F14856AE005AB364DB30ED46CB50

Function 06CEEB78 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91293fd26126d353cc586809ed43b2f2e9c061f2193b7ff8b6f59d93fd256bf
Instruction ID: c66989200fd51dea0e909356a5eb20e2a19624a451d13af5fbc2c2dc09c30d1d
Opcode Fuzzy Hash: e91293fd26126d353cc586809ed43b2f2e9c061f2193b7ff8b6f59d93fd256bf
Instruction Fuzzy Hash: 09711A74A002099FDB54DFA9D980A9EBBF6FF88340F14856AE015EB365DB30ED46CB50

Function 06CEFCD9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858ce8623399a27e27085485632debcd5b5022b492f35d3c02224ee321c771a1
Instruction ID: 306a325b32476ead02b04a8b3d04154a96b117a8663d5d2dacdf61f2f3db6635
Opcode Fuzzy Hash: 858ce8623399a27e27085485632debcd5b5022b492f35d3c02224ee321c771a1
Instruction Fuzzy Hash: 2851E175E01105DFDB24EFB8E5446ADBBB2EF84311F20886EE126D7360DB359A55CB80

Function 06CEFA88 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b27473e7ff7dfb40d63b5d045a231c26c76d71940f8931fae8f9e4a5f46935c
Instruction ID: d243aee37e9d11fc5ac6cf01d85d8bbca792665577f4c58f95beeca52d62facb
Opcode Fuzzy Hash: 4b27473e7ff7dfb40d63b5d045a231c26c76d71940f8931fae8f9e4a5f46935c
Instruction Fuzzy Hash: A951EA70F203048FEF64576CDA6076F36AEE789750F20082ED51AD73A4D96ACD85C3A2

Function 06CEFA98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e524dd3619d65d10b6b7c84425a3d24130f3cf58abea54f55e2ef6c560a6755
Instruction ID: dcf63fc03d18bd9cf4e9ddcaa93405a0bc19c0dbb991da7e9a05fbb18d721665
Opcode Fuzzy Hash: 2e524dd3619d65d10b6b7c84425a3d24130f3cf58abea54f55e2ef6c560a6755
Instruction Fuzzy Hash: 2451D570F202048FEF64676DDA6476F366EE789750F20082ED51AD73A4C96ACD85C3A2

Function 06CE5499 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa41d5b483e21c5bd99bd35261f9e8088088e1897d98a2fa996c9dbdac2f47a
Instruction ID: 777a48757c7fa270d22f230de7ff0e8de2fcb98eacbf5822b703dd4250792ab5
Opcode Fuzzy Hash: 6aa41d5b483e21c5bd99bd35261f9e8088088e1897d98a2fa996c9dbdac2f47a
Instruction Fuzzy Hash: 1A417C71E006098FDF70CFA9C881AAFFBF2EB85314F50492AD256D7250D332E9498B90

Function 06CE5618 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86027cadade1596e7f9d801f52c175aa2c7532513b508b1dc730977cce82ddb
Instruction ID: b747db14cc23eb3ceb3c5b44c60b01a92335249d3a5fedf9b4f15f319322a7e4
Opcode Fuzzy Hash: b86027cadade1596e7f9d801f52c175aa2c7532513b508b1dc730977cce82ddb
Instruction Fuzzy Hash: 7F41B475E102058FDF70CB68C880A7EFBB2FB45314FA4C92AD559DB241C635DA51CB91

Function 06CE2140 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac7a2e6948c3470fc3459ea13347da804ba84af6612038cf37b4a2eb60e633e
Instruction ID: fba285c4d3d00b7099bba4ccb4e5f7bc70ce4f125bb0a0fc5540099c95f27802
Opcode Fuzzy Hash: 8ac7a2e6948c3470fc3459ea13347da804ba84af6612038cf37b4a2eb60e633e
Instruction Fuzzy Hash: 7331AF30E1020A9BDB44CFA5D844AAEBBF6FF88310F108529E906A7350DB75EE46CB50

Function 06CE2150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a9129ec051353d42c2f7f442ef9289ef833e10eb3ff7c99cd114ff4c60934b
Instruction ID: 13273a7614541056f4f0f4e8aa72de60979da7f9c4ca1319e40135567e7b44ec
Opcode Fuzzy Hash: 72a9129ec051353d42c2f7f442ef9289ef833e10eb3ff7c99cd114ff4c60934b
Instruction Fuzzy Hash: AD319C31E1020A9BDB58CFA5C858A9EBBF6FF88310F108529E906E7354DB75EE45CB50

Function 06CE3B21 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b737286df31f0f10dfd9be32179ed60a091dcc63b88a7e425c4c9345c52245a
Instruction ID: 40b89af5f9cce1cb0d4b4815e4d2f0c5e120d61421dd69b4f3f89d1ac38cdfec
Opcode Fuzzy Hash: 4b737286df31f0f10dfd9be32179ed60a091dcc63b88a7e425c4c9345c52245a
Instruction Fuzzy Hash: 5C21AD34F00605AFDB50DF6AD980AAEBBF5EB48310F004029E906E7350E734ED818B94

Function 06CE3B30 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ea39b727a13b8d164bb6e7a169a178078083d6acdfe939c63c706d1a1e1156
Instruction ID: 8cb9afba1afcbb1e01c1c207dc8a0812ab1843e9d190637469ca1f7270cfef1a
Opcode Fuzzy Hash: 00ea39b727a13b8d164bb6e7a169a178078083d6acdfe939c63c706d1a1e1156
Instruction Fuzzy Hash: 6D218C75F006159FDB50DF6AD980AAEB7F1EB48610F10842AE90AE7390E735ED41CB94

Function 02ECD20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4258225128.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ecd000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4aeaadd57dcd810a01b8b13934b8c10547be7a33b7d1bf5f15ed643495053f6
Instruction ID: 031774ef3e1f7948ea2db853447668efc9f0303cd314a9076269d03abd60dda4
Opcode Fuzzy Hash: d4aeaadd57dcd810a01b8b13934b8c10547be7a33b7d1bf5f15ed643495053f6
Instruction Fuzzy Hash: 84212271584244DFDB089F94DA84B6ABBA5FB84328F30C67DD84D0B249C376D406CA61

Function 02ECD3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4258225128.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ecd000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1469f6124e6aac488540329dc6a3560a4e8304091da10e2d2faaed5b9de4def6
Instruction ID: e072bf348458c7d48f53e81181d148d7506283d3f0a0e1ef22321052a8357350
Opcode Fuzzy Hash: 1469f6124e6aac488540329dc6a3560a4e8304091da10e2d2faaed5b9de4def6
Instruction Fuzzy Hash: 6A21CF71684204DFDB08DF54DA84B26BBA5FB84318F30C57DDA0A4B296C377E847CA61

Function 02ECD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4258225128.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ecd000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9040353ec5494c61d6a859c0f4f9608e1bd4899742fc98585f2766b5eebc36
Instruction ID: c84642fa4f2d3e2b008e49407dcbda2db19009275a58310db5de9df80e62a97f
Opcode Fuzzy Hash: be9040353ec5494c61d6a859c0f4f9608e1bd4899742fc98585f2766b5eebc36
Instruction Fuzzy Hash: 5F21D371544204DFDB14DF58CA85B26BB66EB84328F30C57DE8494B252C737D847CA61

Function 06CE6D70 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b4e37d039edbda76d48d19826b29d4fbe432c4a792f6d2c39195bff876e343
Instruction ID: 856829639fb573d7b700e42c5a2f4b7b849a2cfc6c2596dbb65ee46c1f3e4bc7
Opcode Fuzzy Hash: 02b4e37d039edbda76d48d19826b29d4fbe432c4a792f6d2c39195bff876e343
Instruction Fuzzy Hash: 7121B430F201099FDF54DB6AE95069DB7B6EB84310F248429E405EB354D735EE41CBD4

Function 06CE3C40 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa7a9dcb5450340a44e397e0efdbe534daf610ee0cea63d3187d0700ad0bb47
Instruction ID: 8fa668365e88d31ccc0fff065a9c109afd3dd897a26fb4309e793f4900a4f080
Opcode Fuzzy Hash: 8aa7a9dcb5450340a44e397e0efdbe534daf610ee0cea63d3187d0700ad0bb47
Instruction Fuzzy Hash: 2411AD31B000285FDF54AA69D914AAF73FAEBC8710F008639D80AE7354EE34EC028BD0

Function 06CE38F8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449d654d85466edbe3172a430e5b3eced1fb85cae7307213970020f642804f3b
Instruction ID: 74b2a8ada51d44587580410f8ec8cc35ac826374dbb5d40e9ea64db62959ff77
Opcode Fuzzy Hash: 449d654d85466edbe3172a430e5b3eced1fb85cae7307213970020f642804f3b
Instruction Fuzzy Hash: B92115B5D00259EFCB00DF9AD884ADEFFB8FB49360F10822AE518A7250C774A540CFA4

Function 06CE4280 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7e493c5b9d07f2a3b70dc83c3aabd7714fa188047613890066ac61b37c8a11
Instruction ID: aaaaef55d51c8cd105e5436125b65d225a84cbf9e353912ca597358ff0210394
Opcode Fuzzy Hash: 9c7e493c5b9d07f2a3b70dc83c3aabd7714fa188047613890066ac61b37c8a11
Instruction Fuzzy Hash: 94016430B000010FEB599A7C8414B2FAFE6DBD9620F24C96EE10AC7396E962CD024394

Function 06CEA357 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ed13a191aaee2c513246ad9447d046fe38bb9e4f36084c19f829dcc72abd97
Instruction ID: 7b21062c6ea0c936242e45d440b43403a9788b84477daac5642b33b8407793ea
Opcode Fuzzy Hash: 90ed13a191aaee2c513246ad9447d046fe38bb9e4f36084c19f829dcc72abd97
Instruction Fuzzy Hash: 9701D430B002005FEB619A79D598B1EBBE6EB86610F10882DE64AC7391EE35DD468395

Function 06CEEDE9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d41387fea73e7495e37f72a74a88403236f301c8fa8e61252fdc00fab51cd1c
Instruction ID: c347bffadef5a706364f14a39606517d329eb9317802fe4808df68bed92bff87
Opcode Fuzzy Hash: 9d41387fea73e7495e37f72a74a88403236f301c8fa8e61252fdc00fab51cd1c
Instruction Fuzzy Hash: B7014231B001510FDB658A3D9864B2F7BE6CBCDA60F04882EF10AC7391DA21CE0283D4

Function 02ECD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4258225128.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ecd000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 8f604390e65e0d13749a9f64782c3af3124553593683916048062f8705695556
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0A11AC755442448FCB11CF54CAC4B16BB62FB44228F24C6AEE8494B652C33BD44ACB61

Function 02ECD207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4258225128.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ecd000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 46b719f0183e7cef54c8b5346c3501911dee2c382a2c126f6cca947793e020bc
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: B711D075544284DFDB06CF50DAC4B56BBA1FB84228F24C6AED8490B646C33AD40ACB51

Function 02ECD3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4258225128.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ecd000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a279273d44eb6f8eed6d3fb97dc8ab9df88099f79a84729033347901bad37d32
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7E11BB75544280CFCB05CF50DAC4B15BBA2FB84218F24C6AED9494B256C33BE44ACBA1

Function 06CEFF2B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5842afd087a59ad88f0f85572f77159bb73f38de5b44a90929b378ac2e30a7
Instruction ID: 9df93cc5b79b8f447010699f89b026ba0e3c3952154b5149b99833b0bbd1b4de
Opcode Fuzzy Hash: fa5842afd087a59ad88f0f85572f77159bb73f38de5b44a90929b378ac2e30a7
Instruction Fuzzy Hash: 4001D234A052484FCB51DF7DE9106AEBBF5EB85204F1041BFD929D7267EB388941C7A2

Function 06CE3900 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecf6535de5f99665c7186ccb7768543f26daf6d6309a6384812c66854b2bac5
Instruction ID: 91b30eb8f7b73741d4742f34bfeb798fe300688589ba9063e611642a3c942dc4
Opcode Fuzzy Hash: 4ecf6535de5f99665c7186ccb7768543f26daf6d6309a6384812c66854b2bac5
Instruction Fuzzy Hash: 9911B0B5D01259EFCB00DF9AD884ADEFFB4FB49320F50812AE918A7250C374A954CFA5

Function 06CE4290 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3caebd2945f9172d57fe40e4d768a4ae171cb205b22756052b3779bc618abd65
Instruction ID: a5c9df44542e8c8680daa761ae44fadd66a3e974b23447bc0f1b7cc812e711e4
Opcode Fuzzy Hash: 3caebd2945f9172d57fe40e4d768a4ae171cb205b22756052b3779bc618abd65
Instruction Fuzzy Hash: C3018631B005100BDB589A7D9454B2FB7EADBD9750F20C83EE10BC7354ED65DD424395

Function 06CE3C2F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243cc84adc0159b362d4aef4947bb67a5f1fe23754d2197f8f79314f8468c291
Instruction ID: 3458a3ed79df98cb4a53361dbd429ca3c8f1376611b19e494b488e19594c7f1a
Opcode Fuzzy Hash: 243cc84adc0159b362d4aef4947bb67a5f1fe23754d2197f8f79314f8468c291
Instruction Fuzzy Hash: 9001DF31B040685BDF94AA79DC146AF76FAEBC8610F00493EE50AD7384EE64DC0247E5

Function 06CEEDF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2a77140c75268aff90ba51810dede370e73937a424904da9696f997a60d8f7
Instruction ID: e9fa728b1e3717b43869ea20aceaa4ca5fcf15dafa0c042571dfae3a48a68cc8
Opcode Fuzzy Hash: 8f2a77140c75268aff90ba51810dede370e73937a424904da9696f997a60d8f7
Instruction Fuzzy Hash: 1801AF31B005114FDB649A7E94A4B2EB7E6DBCDAA0F10883EE20AC7354EE26DD0243D5

Function 06CEA368 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2d6733ee8163a14ddabdec03d413c19d9b0751991d3ce6a4dcd1dfb6e9949a
Instruction ID: 8e73ace4ce0ebf8e887b0bcf438e9c8f4d00b2671f8838d5caef6cb6026d6b7d
Opcode Fuzzy Hash: 1e2d6733ee8163a14ddabdec03d413c19d9b0751991d3ce6a4dcd1dfb6e9949a
Instruction Fuzzy Hash: FB018130B001145FDB50AA7AD598B2EB7E6E785610F10882DE60AC7354EA25DD458385

Function 06CEFF48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270dd17d24fa6f55db4bcb568bf16d223494b6bd1a79945257be639d66118582
Instruction ID: d07766651361a00a84193dd4f0376a6725e248f4d611df3e684d1f8bda064cf4
Opcode Fuzzy Hash: 270dd17d24fa6f55db4bcb568bf16d223494b6bd1a79945257be639d66118582
Instruction Fuzzy Hash: 79F0F874A012098FD781EF7DD61026EB7F6EB88200F10827D8929D7769EB749D81CB91

Function 06CE64C9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f985364182a36559ef24aff5aa800a1dcb1fbecb1859b07256626890a3d4e2c
Instruction ID: 66f100316239e94100121a5d448ef461cc691ec3603029895cfdbed7e0afa5ca
Opcode Fuzzy Hash: 3f985364182a36559ef24aff5aa800a1dcb1fbecb1859b07256626890a3d4e2c
Instruction Fuzzy Hash: DEE0D871D242885BDF61DE75C915B5ABBF9DB12304F2088EAD448CB242F576CE019391

Non-executed Functions

Function 06CE76F8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$kq, xrefs: 06CE7BB1
$kq, xrefs: 06CE7C50
$kq, xrefs: 06CE7BA5
$kq, xrefs: 06CE7C66
$kq, xrefs: 06CE77E8
$kq, xrefs: 06CE7C44
$kq, xrefs: 06CE7819
$kq, xrefs: 06CE77F4
$kq, xrefs: 06CE7825
$kq, xrefs: 06CE7C5A

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: c3bb0c811b76fc1a152da02b2dbe5a948fda4cc52d870832c3f58660739a578a
Instruction ID: b76db335a3e67518bf9e51d5918bdebf38b8fb776a4094628926ba413d3ee9fe
Opcode Fuzzy Hash: c3bb0c811b76fc1a152da02b2dbe5a948fda4cc52d870832c3f58660739a578a
Instruction Fuzzy Hash: D6122D34E01219CFDB64EF69C994A9EB7B6BF88300F208569D509AB364DB349D85CF90

Function 06CEA990 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$kq, xrefs: 06CEAAE1
$kq, xrefs: 06CEAB0C
$kq, xrefs: 06CEAA86
$kq, xrefs: 06CEAAED
$kq, xrefs: 06CEAB42
$kq, xrefs: 06CEAB4E
$kq, xrefs: 06CEAB18
$kq, xrefs: 06CEAA92

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: a7986a35dcc576101842c5e0204d0df1d6a1c6569862df6772385cb9e511909b
Instruction ID: 8f35b3de04f92078227c95eb5c6f68d651b8b6df838db3b40bfd65d1c9389e6f
Opcode Fuzzy Hash: a7986a35dcc576101842c5e0204d0df1d6a1c6569862df6772385cb9e511909b
Instruction Fuzzy Hash: 0B914E30E513099FEB68EFA5D6547AEBBF2EF84300F208529D4019B394DB799D81CB90

Function 06CE70F8 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$kq, xrefs: 06CE7594
$kq, xrefs: 06CE73DA
$kq, xrefs: 06CE760C
$kq, xrefs: 06CE7600
$kq, xrefs: 06CE7440
$kq, xrefs: 06CE7434

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: be1a4fc29e7244a615a068a3afd032b70d44607f061bdce08dbabffb6354c68f
Instruction ID: a8f92dbf87b07a38c6310f9ca734a165b7efb335c31186dbb6809e5fd46b3527
Opcode Fuzzy Hash: be1a4fc29e7244a615a068a3afd032b70d44607f061bdce08dbabffb6354c68f
Instruction Fuzzy Hash: ECF16E34B01208DFDB54EF69D594A6EBBB6FF84304F248569D4059B3A8DB35EC82CB50

Function 06CE8428 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$kq, xrefs: 06CE86E7
$kq, xrefs: 06CE8682
$kq, xrefs: 06CE868E
$kq, xrefs: 06CE86F3

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: d5efd9a24b002dccb5e693d8b3d55afb062ba296357da160324753e381f3d674
Instruction ID: a744f810eb1ac9425ccca102518dac3634825f2cd1def8ba8021fb5b83acfa88
Opcode Fuzzy Hash: d5efd9a24b002dccb5e693d8b3d55afb062ba296357da160324753e381f3d674
Instruction Fuzzy Hash: B9B13C34A122098FDB64EF69D59469EB7B6FF84300F24882ED406DB394DB75DD82CB90

Function 06CE8840 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$kq, xrefs: 06CE88CB
LRkq, xrefs: 06CE8933
LRkq, xrefs: 06CE8982
$kq, xrefs: 06CE88BF

Memory Dump Source

Source File: 0000000E.00000002.4279440475.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ce0000_LIWBHGsz.jbxd

Similarity

API ID:
String ID: LRkq$LRkq$$kq$$kq
API String ID: 0-2392252538
Opcode ID: ae4a446c8438ae751e464db6009d815f9d487cdc22ff8a26efc9b2d0ecfaedbd
Instruction ID: f009fe932b6e5fb14b4812684d1814a03fb54bd02dbc6014a3a7dc47608d9501
Opcode Fuzzy Hash: ae4a446c8438ae751e464db6009d815f9d487cdc22ff8a26efc9b2d0ecfaedbd
Instruction Fuzzy Hash: 5051D830B012018FDB64DF25DA40A6AB7F6FF88310F14856EE5069B3A5DB34EC80CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL Delivery Invoice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Delivery Invoice.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LIWBHGsz.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_22cz4tvm.3ai.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgyrvunt.s1o.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocqnukxp.kmd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oga4e2tx.x1a.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pa00wwmt.5p0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qik2rph4.ezo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qim5ulos.tk0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r33wqbcv.5wn.psm1

C:\Users\user\AppData\Local\Temp\tmpC314.tmp

C:\Users\user\AppData\Local\Temp\tmpD6AC.tmp

Windows Analysis Report
DHL Delivery Invoice.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre