Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
Analysis ID:	1520636
MD5:	62e11691c457a43738b01faca500f688
SHA1:	341a62aad64638762a3d43594e3f0e413e369160
SHA256:	6f63c579d6602b9cf683cfe5f24a46db07491ea23703d83ccebff4829fa78227
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe (PID: 2544 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe" MD5: 62E11691C457A43738B01FACA500F688)

InstallUtil.exe (PID: 5804 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 6532 cmdline: C:\Windows\system32\WerFault.exe -u -p 2544 -s 1060 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.fasmacopy.gr", "Username": "info@fasmacopy.gr", "Password": "Fam28sjd"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4619850731.000000000309B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4619850731.000000000309B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: InstallUtil.exe PID: 5804	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5804	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33455:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334c7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33551:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3364d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33755:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337e5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33455:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334c7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33551:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3364d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33755:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337e5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31655:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316c7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31751:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3184d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31955:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319e5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31655:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316c7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31751:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3184d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31955:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319e5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33455:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6de9d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334c7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df0f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33551:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6df99:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e02b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3364d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e095:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e107:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33755:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e19d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337e5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e22d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 79.170.44.32, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 5804, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49715

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:38:42.830784+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49715	79.170.44.32	587	TCP
2024-09-27T17:38:45.698806+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49727	79.170.44.32	587	TCP
2024-09-27T17:38:46.036390+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49726	79.170.44.32	587	TCP
2024-09-27T17:38:57.325216+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49728	79.170.44.32	587	TCP
2024-09-27T17:39:17.425776+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49730	79.170.44.32	587	TCP
2024-09-27T17:39:27.102180+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49732	79.170.44.32	587	TCP
2024-09-27T17:39:58.064798+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49733	79.170.44.32	587	TCP
2024-09-27T17:40:03.140998+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49734	79.170.44.32	587	TCP
2024-09-27T17:40:11.568549+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49735	79.170.44.32	587	TCP
2024-09-27T17:40:14.729449+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49736	79.170.44.32	587	TCP
2024-09-27T17:40:19.856620+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49738	79.170.44.32	587	TCP
2024-09-27T17:40:39.530629+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49739	79.170.44.32	587	TCP
2024-09-27T17:40:48.065225+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49741	79.170.44.32	587	TCP
2024-09-27T17:40:58.853873+0200	2030171	1	A Network Trojan was detected	192.168.2.6	49744	79.170.44.32	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:38:45.698806+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49727	79.170.44.32	587	TCP
2024-09-27T17:38:46.036390+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49726	79.170.44.32	587	TCP
2024-09-27T17:38:57.325216+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49728	79.170.44.32	587	TCP
2024-09-27T17:39:17.425776+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49730	79.170.44.32	587	TCP
2024-09-27T17:39:27.102180+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49732	79.170.44.32	587	TCP
2024-09-27T17:39:58.064798+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49733	79.170.44.32	587	TCP
2024-09-27T17:40:03.140998+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49734	79.170.44.32	587	TCP
2024-09-27T17:40:11.568549+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49735	79.170.44.32	587	TCP
2024-09-27T17:40:14.729449+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49736	79.170.44.32	587	TCP
2024-09-27T17:40:19.856620+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49738	79.170.44.32	587	TCP
2024-09-27T17:40:39.530629+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49739	79.170.44.32	587	TCP
2024-09-27T17:40:48.065225+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49741	79.170.44.32	587	TCP
2024-09-27T17:40:58.853873+0200	2840032	1	A Network Trojan was detected	192.168.2.6	49744	79.170.44.32	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.fasmacopy.gr", "Username": "info@fasmacopy.gr", "Password": "Fam28sjd"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49712 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb89B source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2195624222.0000016BB8C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb/g source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E965000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERF267.tmp.dmp.5.dr
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDB source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192097688.0000003F6ECF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb- source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pC:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDB source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192097688.0000003F6ECF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF267.tmp.dmp.5.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERF267.tmp.dmp.5.dr
Source:	Binary string: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDBQ source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192097688.0000003F6ECF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E965000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbphic Provider source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbolean) source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2195624222.0000016BB8C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDB source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERF267.tmp.dmp.5.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49715 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49728 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49728 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49732 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49732 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49730 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49730 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49736 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49736 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49734 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49734 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49726 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49726 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49735 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49735 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49733 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49733 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49727 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49727 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49738 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49741 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49741 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49738 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49739 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49739 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:49744 -> 79.170.44.32:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.6:49744 -> 79.170.44.32:587

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 79.170.44.32:587

Source: Joe Sandbox View	IP Address: 79.170.44.32 79.170.44.32
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: GODADDYDE GODADDYDE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 79.170.44.32:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.fasmacopy.gr

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: InstallUtil.exe, 00000002.00000002.4619850731.0000000003274000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.00000000034B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.000000000319E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.000000000354B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.00000000033E3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.0000000003309000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.0000000003109000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.fasmacopy.gr
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: InstallUtil.exe, 00000002.00000002.4619850731.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49712 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, R1W.cs	.Net Code: g4oc3ou
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack, R1W.cs	.Net Code: g4oc3ou

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34694A55	0_2_00007FFD34694A55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD346845F0	0_2_00007FFD346845F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD3468BA69	0_2_00007FFD3468BA69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD346833D0	0_2_00007FFD346833D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD3468E395	0_2_00007FFD3468E395
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34689770	0_2_00007FFD34689770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34683BE9	0_2_00007FFD34683BE9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD346884D3	0_2_00007FFD346884D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD346828FA	0_2_00007FFD346828FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34750186	0_2_00007FFD34750186
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016F41C8	2_2_016F41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016FE281	2_2_016FE281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016FAA1A	2_2_016FAA1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016F4A98	2_2_016F4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016F3E80	2_2_016F3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B36608	2_2_06B36608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B355B8	2_2_06B355B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B3B24B	2_2_06B3B24B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B33068	2_2_06B33068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B3C198	2_2_06B3C198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B376B8	2_2_06B376B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B35CFF	2_2_06B35CFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B3E3B8	2_2_06B3E3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B30040	2_2_06B30040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B30006	2_2_06B30006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_06B30592	2_2_06B30592

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2544 -s 1060

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB1540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTransponer.exe6 vs SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefe669a34-3e15-4019-8593-4c1c330bc15b.exe4 vs SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000000.2134100915.0000016B9E612000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTransponer.exe6 vs SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB18E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTransponer.exe6 vs SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Binary or memory string: OriginalFilenameTransponer.exe6 vs SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb-
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E939000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@4/5@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2544

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\10d55907-4ce7-493c-b531-6b2b3ef723f2

Jump to behavior

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2544 -s 1060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static file information: File size 3814016 > 1048576

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb89B source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2195624222.0000016BB8C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb/g source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E965000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERF267.tmp.dmp.5.dr
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDB source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192097688.0000003F6ECF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb- source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pC:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDB source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192097688.0000003F6ECF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF267.tmp.dmp.5.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERF267.tmp.dmp.5.dr
Source:	Binary string: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDBQ source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192097688.0000003F6ECF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E965000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbphic Provider source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbolean) source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2195624222.0000016BB8C50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.PDB source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2192440263.0000016B9E8E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERF267.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERF267.tmp.dmp.5.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34695091 push ecx; retf	0_2_00007FFD34695092
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34694D57 push ecx; retf	0_2_00007FFD34694D58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34687380 push ebx; retf	0_2_00007FFD346873AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Code function: 0_2_00007FFD34750186 push esp; retf 4810h	0_2_00007FFD34750312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016FA6C0 push F4055CCCh; retf	2_2_016FA84D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016F0C45 push ebx; retf	2_2_016F0C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016F0C53 push ebx; retf	2_2_016F0C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_016F0CCB push edi; retf	2_2_016F0C7A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Memory allocated: 16B9EB10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Memory allocated: 16BB8500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 16F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 5050000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198939	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198825	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198715	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198601	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198491	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197607	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1196937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1196828	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2279			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7554			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -38738162554790034s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -98905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -98718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -98199s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -97093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1199062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198939s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198825s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198715s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198601s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198491s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198389s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1198047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197607s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1197047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1196937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5024	Thread sleep time: -1196828s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98199	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198939	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198825	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198715	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198601	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198491	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1198047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197607	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1197047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1196937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1196828	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: InstallUtil.exe, 00000002.00000002.4622391043.0000000004277000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4622391043.0000000004257000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MEQMM+xyKY/iTSJIHgfSrloXJZ42t0KsSckkZ5Oeaw2SRYBcNFIIT0kKHb+fSleOWOFZ
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: InstallUtil.exe, 00000002.00000002.4624825084.00000000065C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, ----.cs	Reference to suspicious API methods: LoadLibrary((_0607_FBC5._FD40_06DE_0618_FDE5_FBD1_0604_0612))
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, ----.cs	Reference to suspicious API methods: GetProcAddress(intPtr, (_0607_FBC5._FDDF_064D_0656_FBBB))
Source: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, ----.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)array.ToArray().Length, 64u, out var _06FD_0656)
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, moEk.cs	Reference to suspicious API methods: EYAPsVT.OpenProcess(CgGfQLvbm.DuplicateHandle, bInheritHandle: true, (uint)_2y5.ProcessID)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: F7E008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4619850731.000000000309B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5804, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4619850731.000000000309B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5804, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d7ef88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe.16bb0d44540.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4619850731.000000000309B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe PID: 2544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5804, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	231 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	151 Virtualization/Sandbox Evasion	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.fasmacopy.gr	79.170.44.32	true	true		unknown
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	false	URL Reputation: safe	unknown
https://api.ipify.org	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	false	URL Reputation: safe	unknown
https://account.dyn.com/	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe, 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	false	URL Reputation: safe	unknown
http://mail.fasmacopy.gr	InstallUtil.exe, 00000002.00000002.4619850731.0000000003274000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.00000000034B6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.000000000319E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.000000000354B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.00000000033E3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.0000000003309000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4619850731.0000000003109000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 00000002.00000002.4619850731.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.170.44.32	mail.fasmacopy.gr	United Kingdom		20773	GODADDYDE	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520636
Start date and time:	2024-09-27 17:36:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@4/5@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 84% Number of executed functions: 70 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Simulations

Behavior and APIs

Time	Type	Description
11:37:01	API Interceptor	10962615x Sleep call for process: InstallUtil.exe modified
11:37:03	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
79.170.44.32	nkVQ.exe	Get hash	malicious	AgentTesla	Browse
	RFQ SC 3003742364wf#U180ed#U180ep#U180e..exe	Get hash	malicious	AgentTesla	Browse
	P.O. F0N82599 FORJA rom.exe	Get hash	malicious	AgentTesla	Browse
	Milieuskadeligst.exe	Get hash	malicious	AgentTesla	Browse
	3z5nZg91qJ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	GkYUK8VCrO.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	RFQ_4155965-EU2406.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ltd93En22P.exe	Get hash	malicious	AgentTesla	Browse
	ejXrW4Jf9o.exe	Get hash	malicious	AgentTesla	Browse
	U39qqK8E7o.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	file.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	rQuotation3200025006.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://mzansibonds.com/dshk/tmpasdfghjklkjhgfdewertyuioiuytresdxcvbnmnbvfcdsew345678987654rewsdfvgbhnjhbgvfdesw23e45678uijdhgfcsvzbdncqasdcxw.php	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://correctingservicesalakks.pages.dev/	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
mail.fasmacopy.gr	nkVQ.exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
	RFQ SC 3003742364wf#U180ed#U180ep#U180e..exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
	P.O. F0N82599 FORJA rom.exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
	Milieuskadeligst.exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
	3z5nZg91qJ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	79.170.44.32
	GkYUK8VCrO.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	79.170.44.32
	RFQ_4155965-EU2406.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	79.170.44.32
	ltd93En22P.exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
	ejXrW4Jf9o.exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
	U39qqK8E7o.exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GODADDYDE	nkVQ.exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
	ExeFile (317).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	ExeFile (156).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	ExeFile (196).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	ExeFile (106).exe	Get hash	malicious	Emotet	Browse	83.169.36.251
	RFQ SC 3003742364wf#U180ed#U180ep#U180e..exe	Get hash	malicious	AgentTesla	Browse	79.170.44.32
CLOUDFLARENETUS	Quote #270924.exe	Get hash	malicious	FormBook	Browse	172.67.165.25
	https://effective-teammates-567500.framer.app/	Get hash	malicious	HTMLPhisher	Browse	172.65.208.22
	ATT71817.docx	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	FoS5cjKhd3.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.162.108
	https://www.google.fr/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fcasaderestauraciononline.com%2Fholy%2Findexsyn1.html%23cmltYS5hbWV1ckBjYXRhbGluYW1hcmtldGluZy5mcg==	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	0225139776.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://careeligibility.vercel.app/chubedan	Get hash	malicious	HTMLPhisher	Browse	172.67.75.166
	https://clicktracking.yellowbook.com/trackinguserwebapp/tracking.html?MB_ID=256862&SE_ID=9&AG_ID=2952701&AD_ID=6851395&kw=restaurants%20near%20me&kw_type=p&C_ID=874339&SE_AD_ID=73873744870314&se_clk_id=0651300f23401ca1b2e355991fb49377&hibu_site=0&redirect_url=https://femalewhowork.sa.com/rUswT/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://effective-teammates-567500.framer.app/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://main.d3engbxc9elyir.amplifyapp.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.74.152
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://polskie-torrenty.eu/redir.php?url=https://globalfinanceweb.com%2FProfile%2Fluig%2Fnzx0k%2FmProtect.html%23abrumley@highlandfunds.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	rQuotation3200025006.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	.05.2024.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EP144UTC55LADQ1M_566591d2b953a70a81c6aa39397b5bad4c56aed_37c5cacb_1b37c6ba-e108-4c33-a97e-31b9def44dae\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0332078549834032
Encrypted:	false
SSDEEP:	192:0uG0QBaJ21Ii0XcnuaWBUUIzuiFVZ24lO8/:S0h21+XcnuamUxzuiFVY4lO8/
MD5:	8F167C90DF9EEBDD435310A68D149853
SHA1:	5015C19FB45CDB1C39CA68A3796CAFF701F6916D
SHA-256:	7C2F665B1AC16E3F702864A5C4600379AABE44D2ECF7CB3045ABD6A62789D308
SHA-512:	5F59C6CFAB5DDA2C066357C00032043EAB5BE034E2C1A4EDD612F4EC7F9E538E13B9661361B3E8759EA6787EDFB11A71D0C9BD158015EF6E24829DD011E0DFD8
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.9.2.5.0.1.9.9.9.5.3.3.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.9.2.5.0.2.0.5.5.7.8.2.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.3.7.c.6.b.a.-.e.1.0.8.-.4.c.3.3.-.a.9.7.e.-.3.1.b.9.d.e.f.4.4.d.a.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.c.0.7.5.7.3.-.4.7.a.1.-.4.c.e.0.-.b.a.f.3.-.3.3.a.0.5.8.8.a.c.f.8.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...P.a.c.k.e.d.N.E.T...3.0.6.5...2.0.0.9.9...2.6.1.3.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.p.o.n.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.f.0.-.0.0.0.1.-.0.0.1.5.-.5.1.1.7.-.3.5.1.6.f.3.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.8.7.8.5.3.e.9.0.f.6.0.5.6.a.0.6.1.c.8.9.8.f.b.9.d.3.d.a.1.c.a.0.0.0.0.0.0.0.0.!.0.0.0.0.3.4.1.a.6.2.a.a.d.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF267.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Fri Sep 27 15:37:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	375238
Entropy (8bit):	3.3156118971765447
Encrypted:	false
SSDEEP:	3072:pGcB+xT81CCqSpAv3+vIc4ZcS2elBGECjz:QxGqsAv3Q/Y2JZ
MD5:	5FF9EF10BC195520A315865F4D30C613
SHA1:	6D56538E0BF3767507D639DB72388C2400650F11
SHA-256:	66FF6BC118FB11F95E8F287A4BBBC408FD452755F5B386E6D26603D475B61A24
SHA-512:	5D0ECF9A1D419DF1B2623178E678C1A12C7083AE80C1179828A78EEC866BF363D6F5470F0A1A09C29718C0A0D82148C4FB0C84984293546237401BEA2F87EE17
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f....................................$.......................DH..vo..........l.......8...........T............)..&............6...........8..............................................................................eJ......X9......Lw......................T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3A1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8736
Entropy (8bit):	3.7110812899303407
Encrypted:	false
SSDEEP:	192:R6l7wVeJE1d4e6Y2DrXcgmfZXsprY89bir0f12m:R6lXJep6Y2XcgmfZMiIfN
MD5:	6DC210408381482912BFF51C3EFAF5C7
SHA1:	17010D558A201F7A6DC16B94B988690B54822C1D
SHA-256:	7B8386844E48BA82D2A99F1557000AA0762C9017F1AD48F050CA60BCEAFFCF20
SHA-512:	5EEB61BE4EB4D76EB031257C8642C1BD71C1274987BC862E0C1872A492A8CA67A4277BF0176578176D892F13B4131BDFFCD8AE5E42A7C031574C245EF0A90215
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3C1.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4974
Entropy (8bit):	4.60043917380332
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg771I9h+WpW8VYjQYm8M4JGE6Fwsyq8vIEi5z//hd:uIjf1I76/7VUJXVsWlEL/hd
MD5:	BA4FF7619F91E3CA58AB48552395F698
SHA1:	312E886C4857A55490202AD587641D76F9E236AC
SHA-256:	48E82B5ECF573C0F81A98BCA8264D424108FACF6986897ED7C3A0B86628C8854
SHA-512:	9E8D540B82CFBC200B5CA4D0EF61C67C12BA77E2E54DBC03A0FDD9515502955E631E424E644D6C83EBA538F97B80ADCBBF3463EE1D639A7C0A32762EF10B9ED8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="518799" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4690378181600225
Encrypted:	false
SSDEEP:	6144:NzZfpi6ceLPx9skLmb0f9ZWSP3aJG8nAgeiJRMMhA2zX4WABluuN1jDH5SG:FZHt9ZWOKnMM6bFpTj4G
MD5:	F7C438C006F836E65DA58E2E880BD2FB
SHA1:	0611D057281F787D43B5F9599F3CDFD45761F3E1
SHA-256:	CA6BF50F3608F021E5AD7426615A47E597588B446E85035D01DBADE0ED40541A
SHA-512:	34C31718296996F78E97EF3972A8EBE7342899CF02E4EBBCE04FCE4868AF0E7061D054EA2F66D7E55BA122117097E7FEDFF7E5292198ECF77263D550FFF424A2
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..H.................................................................................................................................................................................................................................................................................................................................................W.^#........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.528395619447339
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
File size:	3'814'016 bytes
MD5:	62e11691c457a43738b01faca500f688
SHA1:	341a62aad64638762a3d43594e3f0e413e369160
SHA256:	6f63c579d6602b9cf683cfe5f24a46db07491ea23703d83ccebff4829fa78227
SHA512:	3601e50e282c62ecac88e4b3a727df6cbb7447ba9901a36f6515bd949dde53548d27f7566dca73106163792a2daff9a4bbf59f4fc530ee01d0050fe52256f73e
SSDEEP:	12288:iFXhF2Gkx9Mjx/6MEFcfuxPVXsUGeovRJ4Y45S2R0JhAICryO8C/8pod7gO5Qz7/:qbom96CQ1ovHD4pKEICrn8AZQz7/
TLSH:	45065712361BAC9FFC151678E0E2B1FA18FC9D13BAF6164FCF229C661A2193D2C41975
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...h..f.........."...0..9...O........... ....@...... ..............................on:...`................................

File Icon


Icon Hash:	55f6b6c2c8e4f055

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F2A468 [Tue Sep 24 11:37:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	27/09/2024 12:44:19 27/09/2025 12:44:19
Subject Chain	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Version:	3
Thumbprint MD5:	BEE8363CD8AD2F5F5E9D7A99F1E33AD1
Thumbprint SHA-1:	B55CF8A6F3766CF6AF562DB97667E5E70825BA25
Thumbprint SHA-256:	6FA106DD8C07239D2E21E819C797BBA3521758AB9DE61B041D0462BB2968836D
Serial:	66279CD5B87B467089BAA6E4483603E4

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x34e7a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3a1420	0x1e60
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x39a8	0x3a00	f33d8a9f755c44c0fae3504f8d3eab1f	False	0.6510641163793104	data	6.2848895555453765	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x34e7a	0x35000	5ce81fec0598feacf722cb2ecbd6f471	False	0.3731758549528302	data	6.1497257943494885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x62f4	0x65fd	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.000229805814087
RT_ICON	0xc8f4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.2233822311605347
RT_ICON	0x1d11c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.296089972671852
RT_ICON	0x265c4	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.28887218045112784
RT_ICON	0x2cdac	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.33410351201478744
RT_ICON	0x32234	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.32368918280585735
RT_ICON	0x3645c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.39885892116182575
RT_ICON	0x38a04	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.4308161350844278
RT_ICON	0x39aac	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.5385245901639344
RT_ICON	0x3a434	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5549645390070922
RT_GROUP_ICON	0x3a89c	0x92	data	0.7191780821917808
RT_VERSION	0x3a930	0x360	data	0.41087962962962965
RT_MANIFEST	0x3ac90	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T17:38:42.830784+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49715	79.170.44.32	587	TCP
2024-09-27T17:38:45.698806+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49727	79.170.44.32	587	TCP
2024-09-27T17:38:45.698806+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49727	79.170.44.32	587	TCP
2024-09-27T17:38:46.036390+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49726	79.170.44.32	587	TCP
2024-09-27T17:38:46.036390+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49726	79.170.44.32	587	TCP
2024-09-27T17:38:57.325216+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49728	79.170.44.32	587	TCP
2024-09-27T17:38:57.325216+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49728	79.170.44.32	587	TCP
2024-09-27T17:39:17.425776+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49730	79.170.44.32	587	TCP
2024-09-27T17:39:17.425776+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49730	79.170.44.32	587	TCP
2024-09-27T17:39:27.102180+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49732	79.170.44.32	587	TCP
2024-09-27T17:39:27.102180+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49732	79.170.44.32	587	TCP
2024-09-27T17:39:58.064798+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49733	79.170.44.32	587	TCP
2024-09-27T17:39:58.064798+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49733	79.170.44.32	587	TCP
2024-09-27T17:40:03.140998+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49734	79.170.44.32	587	TCP
2024-09-27T17:40:03.140998+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49734	79.170.44.32	587	TCP
2024-09-27T17:40:11.568549+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49735	79.170.44.32	587	TCP
2024-09-27T17:40:11.568549+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49735	79.170.44.32	587	TCP
2024-09-27T17:40:14.729449+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49736	79.170.44.32	587	TCP
2024-09-27T17:40:14.729449+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49736	79.170.44.32	587	TCP
2024-09-27T17:40:19.856620+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49738	79.170.44.32	587	TCP
2024-09-27T17:40:19.856620+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49738	79.170.44.32	587	TCP
2024-09-27T17:40:39.530629+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49739	79.170.44.32	587	TCP
2024-09-27T17:40:39.530629+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49739	79.170.44.32	587	TCP
2024-09-27T17:40:48.065225+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49741	79.170.44.32	587	TCP
2024-09-27T17:40:48.065225+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49741	79.170.44.32	587	TCP
2024-09-27T17:40:58.853873+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	49744	79.170.44.32	587	TCP
2024-09-27T17:40:58.853873+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.6	49744	79.170.44.32	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:37:01.133105040 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.133219957 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.133311033 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.143224955 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.143254995 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.629853964 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.629929066 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.633588076 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.633608103 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.633919001 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.688009977 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.708040953 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.755409002 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.836838007 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.836922884 CEST	443	49712	172.67.74.152	192.168.2.6
Sep 27, 2024 17:37:01.836985111 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:01.842859030 CEST	49712	443	192.168.2.6	172.67.74.152
Sep 27, 2024 17:37:02.547117949 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:02.552038908 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:02.554501057 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:03.593198061 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:03.595170021 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:03.600068092 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:03.778789997 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:03.784490108 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:03.791064978 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:03.968907118 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:03.972501040 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:03.977678061 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.157753944 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.157938004 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:04.162837982 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.340660095 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.340806961 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:04.345633984 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.527959108 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.528115034 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:04.533037901 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.726895094 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.727474928 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:04.727538109 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:04.727552891 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:04.727583885 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:37:04.732242107 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.732352972 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.732469082 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:04.732486010 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:05.339740038 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:37:05.391074896 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:42.438726902 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:42.451628923 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:42.830645084 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:42.830784082 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:42.830972910 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:42.831027031 CEST	49715	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:42.837671041 CEST	587	49715	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:43.920809984 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:43.926208973 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:43.926338911 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:43.945481062 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:43.950501919 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:43.950664043 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:44.519586086 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:44.522922993 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:44.528486013 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:44.704457998 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:44.750653982 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:44.761790991 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:44.768968105 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:44.898478031 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:44.898762941 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:44.903708935 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:44.942212105 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:44.943197012 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:44.948108912 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.081398964 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.094620943 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.099678993 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.126303911 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.128060102 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.133122921 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.286684036 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.288269997 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.293068886 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.309514999 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.321048975 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.325951099 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.472795963 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.472968102 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.478404999 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.504884005 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.505095959 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.512947083 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.657162905 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.657563925 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.663209915 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.689472914 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.691322088 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.691371918 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.691452026 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.691612005 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.693203926 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.697849989 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698421955 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698431015 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698437929 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698529959 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.698684931 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698693991 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698698044 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698700905 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698709011 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.698806047 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.704852104 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.704999924 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.710267067 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.710352898 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.710352898 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.710474014 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.710556030 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.710726976 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.711018085 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715159893 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715236902 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715313911 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715322018 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715421915 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715466976 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715475082 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715483904 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715576887 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715585947 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715595961 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715676069 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715683937 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715691090 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715698957 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715713978 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715722084 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715895891 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715903997 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715912104 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715919018 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715925932 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715934038 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.715940952 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.845572948 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:45.845748901 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:45.850867033 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.029520988 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.029978991 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.029978991 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.030030012 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.030101061 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.031363010 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.034882069 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.034970999 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.034986019 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.034998894 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.035038948 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.036295891 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.036390066 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.036544085 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.036640882 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.041379929 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041393995 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041471958 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.041527987 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041575909 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041636944 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.041639090 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041678905 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041691065 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.041742086 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.041750908 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041809082 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.041913033 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.041960001 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.042099953 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.046427011 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046514034 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046528101 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046534061 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.046605110 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046627045 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046660900 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.046824932 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046840906 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046876907 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046885014 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046890020 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046895027 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.046938896 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047051907 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047101974 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047120094 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047131062 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047164917 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047226906 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047238111 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047270060 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047272921 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.047277927 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051367044 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051382065 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051440001 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051542044 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051547050 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051552057 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051677942 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051691055 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051704884 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051717997 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051868916 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051882982 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051894903 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051918030 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.051929951 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.052098036 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.057117939 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.245477915 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.328161001 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:46.623348951 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:46.672460079 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:54.807653904 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:54.812618971 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.192251921 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.192356110 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.192416906 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:55.192456961 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:55.192456961 CEST	49726	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:55.197191954 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.197278023 CEST	587	49726	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.574961901 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.575196028 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.575239897 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:55.575268984 CEST	49727	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:55.576057911 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:55.581455946 CEST	587	49727	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.581687927 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:55.581753016 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:56.165330887 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.184921026 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:56.189795971 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.367497921 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.367793083 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:56.372888088 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.552691936 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.556864977 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:56.563019037 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.761415958 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.761548042 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:56.766524076 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.944422960 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:56.944528103 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:56.949390888 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.131848097 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.131974936 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.136977911 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.314327955 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.314660072 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.314660072 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.314660072 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.315150976 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.319667101 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.319678068 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.319688082 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.320035934 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.320056915 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.325143099 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.325216055 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.325242043 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.325330973 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.330449104 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.330565929 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.330595970 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.330662966 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.335571051 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.335628033 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.335653067 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.335686922 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.335695982 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.335714102 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.335774899 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.335891962 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.335901022 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336368084 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336376905 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336385965 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336394072 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336402893 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336411953 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336421013 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336430073 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336432934 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336441994 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336450100 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336453915 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336462021 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.336471081 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340569973 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340764046 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340773106 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340868950 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340878010 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340886116 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340893984 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340902090 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340910912 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.340918064 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.341010094 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:38:57.345909119 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.831300974 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:38:57.938790083 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:13.333455086 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:13.338269949 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:13.718130112 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:13.718250036 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:13.719152927 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:13.719815969 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:13.719877958 CEST	49728	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:13.723052025 CEST	587	49728	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:13.724333048 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:13.724477053 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:14.487637997 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:14.487773895 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:14.494735003 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:14.676035881 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:14.678949118 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:14.685578108 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:14.864207029 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:14.866974115 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:14.871989965 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.282998085 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.283883095 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.284007072 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:15.284157038 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:15.289541006 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.470976114 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.471127987 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:15.482217073 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.578978062 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:15.584230900 CEST	587	49729	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.584331036 CEST	49729	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:15.658814907 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:15.664062977 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:15.664212942 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:16.272413015 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:16.272551060 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:16.278775930 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:16.462193966 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:16.462371111 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:16.473138094 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:16.648709059 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:16.651108980 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:16.656049013 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:16.833987951 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:16.834152937 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:16.839056969 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.017484903 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.017724991 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.023020029 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.202528954 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.202765942 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.208710909 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.410520077 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.410841942 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.410841942 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.411144972 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.411144972 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.414860010 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.423727989 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.423736095 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.423741102 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.423837900 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.423856974 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.425647020 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425653934 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425663948 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425695896 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425700903 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425776005 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.425820112 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425825119 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425839901 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425848961 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.425901890 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.429523945 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.430869102 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.430887938 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.430911064 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431063890 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.431107998 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431113005 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431215048 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431225061 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431226969 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431227922 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.431349993 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431355000 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431365013 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.431457043 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.431643963 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.436492920 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.436500072 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.436511040 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.436515093 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.436525106 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.436619997 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.436625957 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.436779976 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:17.437369108 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437376022 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437386990 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437588930 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437594891 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437606096 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437645912 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437922955 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.437930107 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438081026 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438086987 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438097000 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438102007 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438477993 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438483000 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438494921 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438499928 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.438616037 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441728115 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441782951 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441891909 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441903114 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441912889 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441924095 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441935062 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.441976070 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:17.988518953 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:18.031900883 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:24.798881054 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:24.812817097 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:25.198839903 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:25.199402094 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:25.200040102 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:25.204920053 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:25.205070019 CEST	49730	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:25.211065054 CEST	587	49730	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:25.211877108 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:25.211990118 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:25.823571920 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:25.823708057 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:25.831229925 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.008097887 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.009057045 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:26.017309904 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.227494001 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.227749109 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:26.239217997 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.502655983 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.502872944 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:26.508742094 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.699613094 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.699752092 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:26.707618952 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.896708965 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:26.902831078 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:26.914167881 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.091691971 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.092240095 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.092294931 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.092294931 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.093364954 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.093364954 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.100750923 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.100899935 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.100904942 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.100985050 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.102042913 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.102047920 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.102052927 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.102058887 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.102178097 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.102180004 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.102183104 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.102195978 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.102293968 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.108788013 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.108983040 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.109061003 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.110240936 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.110372066 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.110377073 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.110474110 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.110476017 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.110856056 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.110970020 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.117841005 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.117897987 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.117938042 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.117995024 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.121792078 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.121798038 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.121809959 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.121817112 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.121870041 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:27.122045994 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.122051001 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.122355938 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.122478008 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.122525930 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.122530937 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.122570992 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.123014927 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.123022079 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.129690886 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.129770994 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.129793882 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136218071 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136260033 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136279106 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136285067 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136332989 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136338949 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136343956 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136348009 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136586905 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136591911 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136603117 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136678934 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136995077 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.136998892 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.137245893 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.137250900 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.137264013 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.695643902 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:27.851788044 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:56.346369982 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:56.347156048 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:56.352096081 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:56.352667093 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:56.352874994 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:56.740115881 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:56.740240097 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:56.741899967 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:56.741983891 CEST	49732	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:56.745214939 CEST	587	49732	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:56.933294058 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:56.933464050 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:56.938683987 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.116740942 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.116920948 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:57.121820927 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.299443960 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.303100109 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:57.308538914 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.488728046 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.488943100 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:57.494132996 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.671612978 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.671762943 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:57.676595926 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.858304977 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:57.858438015 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:57.866784096 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.045067072 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.045547962 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.045615911 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.045659065 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.045730114 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.051155090 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.051184893 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.051212072 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.051238060 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.059495926 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.064606905 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.064702988 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.064798117 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.064868927 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.065028906 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.069822073 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.069902897 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.069957972 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.069966078 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.069991112 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.070069075 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.070096016 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.070187092 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.070195913 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.070291042 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.070508003 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.070590973 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.070607901 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.070698977 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.074924946 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.074989080 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075067997 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.075122118 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075185061 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075244904 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.075254917 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075324059 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075372934 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075381041 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075445890 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075512886 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075520992 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075550079 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075634956 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075644016 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075653076 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075660944 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075674057 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075685024 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075722933 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075757980 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.075834990 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.076019049 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.076096058 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.076105118 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.076126099 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080009937 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080044031 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080053091 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080070972 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080116034 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080125093 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080142975 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080157995 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080399036 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080408096 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.080435038 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.085418940 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.085475922 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:39:58.090349913 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.090754032 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.575185061 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:39:58.625736952 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:00.770937920 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:00.776215076 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.155379057 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.155446053 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.155519962 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:01.155519962 CEST	49733	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:01.156656027 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:01.160501957 CEST	587	49733	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.161881924 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.161952972 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:01.745645046 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.745814085 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:01.750806093 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.928118944 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:01.934931040 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:01.939779997 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.126339912 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.127064943 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:02.131978989 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.541647911 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.542953968 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.547091007 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:02.547091961 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:02.552032948 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.741941929 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.742157936 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:02.746927977 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.927963972 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:02.928164005 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:02.933074951 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.111082077 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.114892006 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.114959955 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.114980936 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.115053892 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.119976044 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.119988918 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.119997025 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.120229959 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.134555101 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.140924931 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.140935898 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.140944958 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.140953064 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.140961885 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.140997887 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.141006947 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.141016006 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.141026020 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.141038895 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.141112089 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.146316051 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146326065 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146389961 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.146433115 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146440983 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146449089 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146459103 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146517992 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.146560907 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146569967 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146584034 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146625996 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.146672964 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.146717072 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.146785021 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.151644945 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151654005 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151704073 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.151756048 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151765108 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151772022 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151779890 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151859999 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151866913 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151886940 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151896000 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151902914 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151911020 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151918888 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151931047 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151938915 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151946068 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151953936 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151961088 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151968956 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151976109 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151988983 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.151995897 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.152003050 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.152010918 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.152018070 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.152025938 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.156476974 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.156593084 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.156605005 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.156631947 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.158509016 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.158596039 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:03.163265944 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.163348913 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.697834015 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:03.750858068 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:09.441814899 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:09.447009087 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:09.826637983 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:09.826812029 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:09.827166080 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:09.827713013 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:09.827790976 CEST	49734	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:09.831702948 CEST	587	49734	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:09.832706928 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:09.832812071 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:10.403703928 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:10.405220032 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:10.410289049 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:10.587929964 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:10.589364052 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:10.594213963 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:10.770076990 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:10.776398897 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:10.781523943 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:10.960524082 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:10.969430923 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:10.974308968 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.150280952 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.154901028 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.159796953 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.338866949 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.346343994 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.351912022 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.528137922 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.528398991 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.528495073 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.528565884 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.528609991 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.533313990 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.533406973 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.533435106 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.533529043 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.561840057 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.568480968 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.568548918 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.568593025 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.568627119 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.568706036 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.568732977 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.568734884 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.568789005 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.573843956 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.573910952 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.573937893 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574014902 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.574047089 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574074030 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574120998 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574146986 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.574184895 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.574197054 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574224949 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574258089 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.574279070 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574306965 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.574321032 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.574342966 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.574398994 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.579225063 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579274893 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579308033 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.579433918 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579461098 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579524040 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579550982 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579576015 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579636097 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579663038 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579688072 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.579715967 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580007076 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580039024 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580045938 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580073118 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580099106 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580123901 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580163956 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580190897 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580234051 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580240011 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580249071 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580274105 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580301046 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.580327034 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.584191084 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.584222078 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.584656000 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.584762096 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:11.584883928 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.584883928 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:11.590009928 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:12.076889992 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:12.125772953 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:12.578613043 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:12.583714008 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:12.961359978 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:12.961417913 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:12.961492062 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:12.961565018 CEST	49735	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:12.963203907 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:12.966490984 CEST	587	49735	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:12.968322992 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:12.968431950 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:13.539604902 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:13.539757013 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:13.544687986 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:13.723359108 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:13.727281094 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:13.732162952 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:13.920830011 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:13.925000906 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:13.930013895 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.115984917 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.122153044 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.127103090 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.343787909 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.354110956 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.359226942 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.540555000 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.541599989 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.546526909 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.722503901 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.722872019 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.722872972 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.722872972 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.722968102 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.724250078 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.728007078 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.728022099 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.728033066 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.728038073 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.728193998 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.729345083 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.729362011 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.729367971 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.729434013 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.729446888 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.729449034 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.729460001 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.729507923 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.729753971 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.729942083 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.732681990 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.732764959 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.741942883 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.742120028 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.747057915 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747183084 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.747222900 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747318983 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.747378111 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747390985 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747396946 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747422934 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747545004 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747565031 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.747648954 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752089977 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752104044 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752115011 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752129078 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752160072 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752172947 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752187967 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752199888 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752244949 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752258062 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752305984 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752321005 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752335072 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752352953 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752377033 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752392054 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752405882 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752459049 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752471924 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752482891 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752494097 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:14.752588987 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:14.757554054 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:15.269901991 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:15.313277006 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:16.631124020 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:16.636040926 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:17.013740063 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:17.014594078 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:17.014689922 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:17.031168938 CEST	49736	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:17.035995007 CEST	587	49736	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:17.063019037 CEST	49737	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:17.067946911 CEST	587	49737	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:17.068022966 CEST	49737	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.110539913 CEST	49737	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.138073921 CEST	587	49737	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.138271093 CEST	49737	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.138887882 CEST	587	49737	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.139102936 CEST	49737	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.139851093 CEST	587	49737	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.140027046 CEST	49737	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.143970966 CEST	587	49737	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.144095898 CEST	49737	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.165024042 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.170591116 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.170903921 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.743961096 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.744189978 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.749105930 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.924895048 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:18.925079107 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:18.929891109 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.116219044 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.116532087 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.121685028 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.301363945 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.301526070 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.306431055 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.483355999 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.483519077 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.488322020 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.668325901 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.668535948 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.673401117 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.849189997 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.849752903 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.849752903 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.849823952 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.849906921 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.851046085 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.855079889 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.855084896 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.855093956 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.855209112 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.855964899 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.855978966 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.856513977 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.856518984 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.856620073 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.859852076 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.861444950 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.861516953 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.861589909 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.861669064 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.861710072 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.861718893 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.861723900 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.861802101 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.861865997 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.861922979 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.866549015 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866604090 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866609097 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866702080 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866704941 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866705894 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.866744041 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866748095 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866782904 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:19.866836071 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866843939 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866847038 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866856098 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866911888 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.866971016 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.867034912 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.867187023 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.867191076 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.867198944 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.867249966 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.867254019 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871577024 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871582985 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871587038 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871591091 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871633053 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871635914 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871680021 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871684074 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871746063 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871750116 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871757984 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871769905 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871773005 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871781111 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871848106 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:19.871850967 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:20.377511978 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:20.458921909 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:37.293031931 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:37.298512936 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:37.679230928 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:37.679552078 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:37.679658890 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:37.681018114 CEST	49738	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:37.681024075 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:37.686158895 CEST	587	49738	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:37.686171055 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:37.686398983 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:38.289328098 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:38.322160006 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:38.329559088 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:38.514791965 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:38.516573906 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:38.526427984 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:38.717248917 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:38.717432022 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:38.726958036 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:38.929620028 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:38.929810047 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:38.943072081 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.121254921 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.121426105 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.127305984 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.325959921 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.326101065 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.337949991 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.523607969 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.523873091 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.523958921 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.523993015 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.524054050 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.525226116 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.529158115 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.529171944 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.529176950 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.529243946 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.529442072 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.530556917 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.530570030 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.530580997 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.530628920 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.530910015 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.530922890 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.530980110 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.531054020 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.531069994 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.531124115 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.534440994 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.535047054 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.536645889 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.537522078 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.537623882 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.537661076 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.537745953 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.540405035 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.540468931 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.541006088 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.543041945 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.546144962 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.546530962 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.546601057 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:39.547048092 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.547152996 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.548161983 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.549490929 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.549596071 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.549597979 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.550177097 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.554824114 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.556813955 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.556998968 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:39.557010889 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:40.094321012 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:40.135206938 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:45.535448074 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:45.542356014 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:45.922365904 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:45.922439098 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:45.922477961 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:45.922538996 CEST	49739	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:45.923962116 CEST	49740	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:45.927490950 CEST	587	49739	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:45.929333925 CEST	587	49740	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:45.929450989 CEST	49740	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:46.219978094 CEST	49740	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:46.227220058 CEST	587	49740	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:46.227284908 CEST	49740	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:46.317706108 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:46.323436975 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:46.323499918 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:46.938390017 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:46.938580036 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:46.943811893 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.121237993 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.121423960 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:47.127228022 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.306278944 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.307198048 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:47.312143087 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.492809057 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.495131016 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:47.499979019 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.678412914 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.678800106 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:47.683670998 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.865405083 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:47.865540028 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:47.873090982 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.056315899 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.056618929 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.056664944 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.056726933 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.056782961 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.058263063 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.064155102 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.064230919 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.064249039 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.064311981 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.064316988 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.065176010 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.065224886 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.065391064 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.065396070 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.065433979 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.065452099 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.069771051 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.069818974 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.073373079 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.073391914 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.073405981 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.073420048 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.073424101 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.073476076 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.075927973 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.075985909 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.076795101 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.076838017 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.084665060 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084681988 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084696054 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084708929 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084722996 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084727049 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.084736109 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084749937 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084764004 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084774017 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:48.084781885 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084795952 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.084809065 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.085791111 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.085818052 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.085832119 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.086994886 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.087009907 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.087023973 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.087037086 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.095274925 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.095338106 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.095352888 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.095969915 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.095988035 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096003056 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096016884 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096030951 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096044064 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096503973 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096518040 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096533060 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096546888 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096564054 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096580029 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096592903 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096606016 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.096620083 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.642755032 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:48.750969887 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:56.590215921 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:56.595191956 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:56.985843897 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:56.985968113 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:56.986002922 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:56.986254930 CEST	49741	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:56.987106085 CEST	49743	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:56.990740061 CEST	587	49741	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:56.991875887 CEST	587	49743	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:56.991966009 CEST	49743	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:57.063714027 CEST	49743	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:57.068665028 CEST	587	49743	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:57.068797112 CEST	587	49743	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:57.068861961 CEST	49743	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:57.119055986 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:57.123913050 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:57.127137899 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:57.699666977 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:57.699873924 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:57.704703093 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:57.880464077 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:57.905774117 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:57.910994053 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.086604118 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.086791039 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.091561079 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.270159006 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.275254965 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.280038118 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.455923080 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.456265926 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.461071014 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.663965940 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.664109945 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.670160055 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.846858978 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.847191095 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.847238064 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.847291946 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.847352028 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.848892927 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.851988077 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.852134943 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.852165937 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.852180958 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.852227926 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.853796005 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.853873014 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.854089022 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.854150057 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.856981039 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.857028961 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.857290983 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.857337952 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.859407902 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.859457970 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.859493971 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.859551907 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.859638929 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.859693050 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.859709978 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.859776020 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.862235069 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.862303972 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.864769936 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.864824057 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.864943027 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.864996910 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:40:58.865031004 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.865082979 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.865087032 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.865104914 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.867306948 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.867341995 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.867351055 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.867558002 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.867566109 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.867573977 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.867583036 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869111061 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869115114 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869148970 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869158030 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869292974 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869301081 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869313002 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869846106 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869889021 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.869996071 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.870006084 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.870022058 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:58.870156050 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:59.383275986 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:40:59.439079046 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:08.425247908 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:08.430119038 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:08.816617012 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:08.816668987 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:08.816812992 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:08.816867113 CEST	49744	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:08.817001104 CEST	49745	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:08.821676016 CEST	587	49744	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:08.821857929 CEST	587	49745	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:08.823399067 CEST	49745	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:09.424382925 CEST	587	49745	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:09.424503088 CEST	49745	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:09.430385113 CEST	587	49745	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:09.609002113 CEST	587	49745	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:09.609680891 CEST	49745	587	192.168.2.6	79.170.44.32
Sep 27, 2024 17:41:09.616508007 CEST	587	49745	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:09.795674086 CEST	587	49745	79.170.44.32	192.168.2.6
Sep 27, 2024 17:41:09.844645023 CEST	49745	587	192.168.2.6	79.170.44.32

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:37:00.762480021 CEST	60150	53	192.168.2.6	1.1.1.1
Sep 27, 2024 17:37:00.769491911 CEST	53	60150	1.1.1.1	192.168.2.6
Sep 27, 2024 17:37:02.411508083 CEST	50365	53	192.168.2.6	1.1.1.1
Sep 27, 2024 17:37:02.546329975 CEST	53	50365	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 17:37:00.762480021 CEST	192.168.2.6	1.1.1.1	0x51e8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:37:02.411508083 CEST	192.168.2.6	1.1.1.1	0xe640	Standard query (0)	mail.fasmacopy.gr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 17:37:00.769491911 CEST	1.1.1.1	192.168.2.6	0x51e8	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:37:00.769491911 CEST	1.1.1.1	192.168.2.6	0x51e8	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:37:00.769491911 CEST	1.1.1.1	192.168.2.6	0x51e8	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:37:02.546329975 CEST	1.1.1.1	192.168.2.6	0xe640	No error (0)	mail.fasmacopy.gr	79.170.44.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	172.67.74.152	443	5804	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:37:01 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-27 15:37:01 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:37:01 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9c929a18ddde96-EWR
2024-09-27 15:37:01 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 27, 2024 17:37:03.593198061 CEST	587	49715	79.170.44.32	192.168.2.6	220 mta1.hi.local ESMTP Exim 4.97.1 Fri, 27 Sep 2024 16:37:03 +0100
Sep 27, 2024 17:37:03.595170021 CEST	49715	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:37:03.778789997 CEST	587	49715	79.170.44.32	192.168.2.6	250-mta1.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:37:03.784490108 CEST	49715	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:37:03.968907118 CEST	587	49715	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:37:04.157753944 CEST	587	49715	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:37:04.157938004 CEST	49715	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:37:04.340660095 CEST	587	49715	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:37:04.340806961 CEST	49715	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:37:04.527959108 CEST	587	49715	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:37:04.528115034 CEST	49715	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:37:04.726895094 CEST	587	49715	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:37:04.727583885 CEST	49715	587	192.168.2.6	79.170.44.32	.
Sep 27, 2024 17:37:05.339740038 CEST	587	49715	79.170.44.32	192.168.2.6	250 OK id=1suD1k-0000000CYKY-2dXj
Sep 27, 2024 17:38:42.438726902 CEST	49715	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:38:42.830645084 CEST	587	49715	79.170.44.32	192.168.2.6	221 mta1.hi.local closing connection
Sep 27, 2024 17:38:44.519586086 CEST	587	49727	79.170.44.32	192.168.2.6	220 mta3.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:38:44 +0100
Sep 27, 2024 17:38:44.522922993 CEST	49727	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:38:44.704457998 CEST	587	49727	79.170.44.32	192.168.2.6	250-mta3.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:38:44.761790991 CEST	49727	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:38:44.898478031 CEST	587	49726	79.170.44.32	192.168.2.6	220 mta2.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:38:44 +0100
Sep 27, 2024 17:38:44.898762941 CEST	49726	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:38:44.942212105 CEST	587	49727	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:38:45.081398964 CEST	587	49726	79.170.44.32	192.168.2.6	250-mta2.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:38:45.094620943 CEST	49726	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:38:45.126303911 CEST	587	49727	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:38:45.128060102 CEST	49727	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:38:45.286684036 CEST	587	49726	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:38:45.309514999 CEST	587	49727	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:38:45.321048975 CEST	49727	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:38:45.472795963 CEST	587	49726	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:38:45.472968102 CEST	49726	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:38:45.504884005 CEST	587	49727	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:38:45.505095959 CEST	49727	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:38:45.657162905 CEST	587	49726	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:38:45.657563925 CEST	49726	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:38:45.689472914 CEST	587	49727	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:38:45.845572948 CEST	587	49726	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:38:45.845748901 CEST	49726	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:38:46.029520988 CEST	587	49726	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:38:46.052098036 CEST	49726	587	192.168.2.6	79.170.44.32	.
Sep 27, 2024 17:38:46.245477915 CEST	587	49727	79.170.44.32	192.168.2.6	250 OK id=1suD3N-0000000DRcM-2XBF
Sep 27, 2024 17:38:46.623348951 CEST	587	49726	79.170.44.32	192.168.2.6	250 OK id=1suD3N-00000001poh-3xji
Sep 27, 2024 17:38:54.807653904 CEST	49726	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:38:55.192251921 CEST	587	49726	79.170.44.32	192.168.2.6	221 mta2.hi.local closing connection
Sep 27, 2024 17:38:55.192416906 CEST	49727	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:38:55.574961901 CEST	587	49727	79.170.44.32	192.168.2.6	221 mta3.hi.local closing connection
Sep 27, 2024 17:38:56.165330887 CEST	587	49728	79.170.44.32	192.168.2.6	220 mta1.hi.local ESMTP Exim 4.97.1 Fri, 27 Sep 2024 16:38:56 +0100
Sep 27, 2024 17:38:56.184921026 CEST	49728	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:38:56.367497921 CEST	587	49728	79.170.44.32	192.168.2.6	250-mta1.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:38:56.367793083 CEST	49728	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:38:56.552691936 CEST	587	49728	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:38:56.761415958 CEST	587	49728	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:38:56.761548042 CEST	49728	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:38:56.944422960 CEST	587	49728	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:38:56.944528103 CEST	49728	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:38:57.131848097 CEST	587	49728	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:38:57.131974936 CEST	49728	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:38:57.314327955 CEST	587	49728	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:38:57.341010094 CEST	49728	587	192.168.2.6	79.170.44.32	.
Sep 27, 2024 17:38:57.831300974 CEST	587	49728	79.170.44.32	192.168.2.6	250 OK id=1suD3Z-0000000CZXr-0y6S
Sep 27, 2024 17:39:13.333455086 CEST	49728	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:39:13.718130112 CEST	587	49728	79.170.44.32	192.168.2.6	221 mta1.hi.local closing connection
Sep 27, 2024 17:39:14.487637997 CEST	587	49729	79.170.44.32	192.168.2.6	220 mta4.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:39:14 +0100
Sep 27, 2024 17:39:14.487773895 CEST	49729	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:39:14.676035881 CEST	587	49729	79.170.44.32	192.168.2.6	250-mta4.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:39:14.678949118 CEST	49729	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:39:14.864207029 CEST	587	49729	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:39:15.282998085 CEST	587	49729	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:39:15.283883095 CEST	587	49729	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:39:15.284157038 CEST	49729	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:39:15.470976114 CEST	587	49729	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:39:15.471127987 CEST	49729	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:39:16.272413015 CEST	587	49730	79.170.44.32	192.168.2.6	220 mta3.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:39:16 +0100
Sep 27, 2024 17:39:16.272551060 CEST	49730	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:39:16.462193966 CEST	587	49730	79.170.44.32	192.168.2.6	250-mta3.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:39:16.462371111 CEST	49730	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:39:16.648709059 CEST	587	49730	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:39:16.833987951 CEST	587	49730	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:39:16.834152937 CEST	49730	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:39:17.017484903 CEST	587	49730	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:39:17.017724991 CEST	49730	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:39:17.202528954 CEST	587	49730	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:39:17.202765942 CEST	49730	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:39:17.410520077 CEST	587	49730	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:39:17.988518953 CEST	587	49730	79.170.44.32	192.168.2.6	250 OK id=1suD3t-0000000DRxi-1KL7
Sep 27, 2024 17:39:24.798881054 CEST	49730	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:39:25.198839903 CEST	587	49730	79.170.44.32	192.168.2.6	221 mta3.hi.local closing connection
Sep 27, 2024 17:39:25.823571920 CEST	587	49732	79.170.44.32	192.168.2.6	220 mta4.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:39:25 +0100
Sep 27, 2024 17:39:25.823708057 CEST	49732	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:39:26.008097887 CEST	587	49732	79.170.44.32	192.168.2.6	250-mta4.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:39:26.009057045 CEST	49732	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:39:26.227494001 CEST	587	49732	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:39:26.502655983 CEST	587	49732	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:39:26.502872944 CEST	49732	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:39:26.699613094 CEST	587	49732	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:39:26.699752092 CEST	49732	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:39:26.896708965 CEST	587	49732	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:39:26.902831078 CEST	49732	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:39:27.091691971 CEST	587	49732	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:39:27.695643902 CEST	587	49732	79.170.44.32	192.168.2.6	250 OK id=1suD43-00000001XSS-01vE
Sep 27, 2024 17:39:56.346369982 CEST	49732	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:39:56.740115881 CEST	587	49732	79.170.44.32	192.168.2.6	221 mta4.hi.local closing connection
Sep 27, 2024 17:39:56.933294058 CEST	587	49733	79.170.44.32	192.168.2.6	220 mta2.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:39:56 +0100
Sep 27, 2024 17:39:56.933464050 CEST	49733	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:39:57.116740942 CEST	587	49733	79.170.44.32	192.168.2.6	250-mta2.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:39:57.116920948 CEST	49733	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:39:57.299443960 CEST	587	49733	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:39:57.488728046 CEST	587	49733	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:39:57.488943100 CEST	49733	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:39:57.671612978 CEST	587	49733	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:39:57.671762943 CEST	49733	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:39:57.858304977 CEST	587	49733	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:39:57.858438015 CEST	49733	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:39:58.045067072 CEST	587	49733	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:39:58.075067997 CEST	49733	587	192.168.2.6	79.170.44.32	+17a+w/FkVrG0VuiN1HWpadDHLcKzQQyyheGMaFsfX A4qMOrbNuW3tsXAJ3N6D35H516NNQhFQT20PEryqV6sqs1rJt/e9Sa3/ANen1p9R2xDT pj+9U0cckrFYopJGAyQiFiB+FOTW5ME2rDa1tMvLaHTZYJrjyZTOsqkxM442kdPdfWsj d984bEZw/wAp+U+h9KN65Qc5f7nB+bnHHrzWFWEasbNnXh6s6EuZI6G58QtFHuivIJW/ u/ZJB/7NVT/hKb30tv8AvzJ/jWVKHhYrNHJGQATvQrgHgdRSKd7oiKzO4yqqpJYew79D XN9Uh/Mdv9oVVo4Gt/wlN76W3/fmT/GoZfFmqK+Ira2kXH3trrz+JqksUzyvElvO0keN 6CJiVz0yMcUkSSTs6wxSysnDBIyxX64HFCwtNO7kKWOrNWULFv8A4S7WP+fK2/8AHv8A GlHi3WCcfYrbp/tf41n7hvCbW3EEgbTk4zn8sH8jTonViCOjKxU46jkcVp9WpdDL67iO v5Fv/hMtX/58bb/x7/Gj/hMtX/58bb/x7/Gs2itPqdIw/tKv3NL/AITLV/8Anxtv/Hv8 aP8AhMtX/wCfG2/8e/xrNoo+p0g/tKv3NH/hMtX/AOfG2/8AHv8AGj/hMtX/AOfG2/8A Hv8AGs6ij6nSH/aVfuaP/CZav/z423/j3+NH/CZav/z423/j3+NZ1FH1OkL+0q/c0f8A hMtX/wCfG2/8e/xo/wCEy1f/AJ8bb/x7/Gs2ij6nSH/aVfuaX/CZav8A8+Nt/wCPf40f 8Jlq/wDz423/AI9/jWbRR9TpB/aVfuaX/CZav/z423/j3+NH/CZav/z423/j3+NZtBo+ p0g/tKv3NL/hMtX/AOfG2/8AHv8AGj/hMtX/AOfG2/8AHv8AGs2ij6nSD+0q/cTWNXvt ZNuLm2jjELEgx57/AF+lA6ClpK3p0o01aJy1q8qz5phRRRWpiFFFFACUUUUAFFBooGFF FJQAUUUUAFFFFAwpKDRQAUlLSUAFFFFAwpKWkoAKKKKAEooooAKKKKBhSUUUDCiiigBK KKKAEooooGFJS0UwEooooGFJRRQAUUUUDEooooASiiigYlFFFABRRSUDCiikoGFFFFAB SUUUDEooooAKSlooGJSUtJTAKKKKQxKDRSUwCiiigYUlLSUAFJS0lAwoopKBhSUtFACU ZoooGJRRRQAUlLSUDCiikoGFFFIaACiiigYGkoooAKSiigYd6SlpKBhRRRQCD3pKKKBh SUtJQMM0UflSUAH0o/OiigAoopKBhRRRQAUn1opaBifjRRRQB0MkN3cW94lrDNMwmtyV iQscYkycD8KrajBcS6dNLPFcWwtYH8q5AxG43f6ts/xZJAwfYjvVqa0hncO6/MOhqNtO tm+8pb6muCeHlJtp7u/4WOWjjIQUbrZW/G5Yvo5ItdJ8i5tFk1eA5uDkXPzHmPgYAzz9 7qOR3yoLiBNF00T293Kxt5TuinVBjzn7FG5981b/ALKs+nl8U+HT7aAMI0xu61jDBzi0 2/6tY6KmZ05QcVEffxT315dwWqzSiO+mM8UQ3Nzt2MVAyR94Z7HPrUVzNGq38N2k8ssT WkcwhlCt5gWTqSrZwMA8dRSnTbUrgJj3FL9iDSRvNNJMY12x+YxOxfQZ6Cj6pNRUb7C/ tCneUratDLeK9SXRL2NZ47aAOZZmHyIvmvkM2Mfd4x3z05qC0nkbSGvf9W1qslsik/N8 7ZjP4BpP++RVptPtnkLlOTT2s4GdXMYyvSq+py11/pk/2jBfZ/pFOKN4rGyj3MQLyXP/ AHxHV66JW2kKjJApPs0Xn+dt+f1qYgEYPSuqlS5E13OCtXVRxdtkVLmGdptVunS6MZwb OaMgQyKWVUjHHJwRwDxt6cUmoM32a9giv4bg2Ko0cUaybht4l5KheSS3BPSlfTbV2JaP r2p32C22BfKGBXL9UntzbHf/AGhS35N9xk63S319qcrSHT2il2S9I3iKEIinoT90beoI 9jUV8sselvceRdQBtNtgbmQ5il4QmNBgYbjrk9DwOom/s62znZ+Hagabaht3l0ng56a/ 1r/mXHMqav7v9af5Db20u53vL4NMbZsm3mjH7sRfwqD0GBxt9eKdNLJ/aOmSRsB/aN/D clVP3VBGR7fOX/75FOFhAGyFI9gaP7Ptssdn3utU8JJxSvsZRx8IycrblWyt73UbGwNk s8qRxFcQ8+XNvOS2Pukjbye2OeKl8yW71ezktQ0kUerSSTMgyqqoh3sT2XOTn3pzabbF cBdvuKWSwSeYzXMsk8p6vIxZj+JqXhKmiTNVmNK8pNPUfobGSNHJJ3SEgn0zT7iG5vY4 4YFlkVJpDNHCNzdF2MVHOPvDPbn1qW3CwFNq/Kp6U24gtLjmSJ8+oYf4V0TovkUV0scd PERVSU31v+JWutQlshfhlM0kTWkN3HnJbKyBhn1xjnsR7USRzwfZbSC5D3MtjJ9lkBxv zOTx6MUyMdc5FS/ZIGkR5nnm8tdiCR87V9BnoKX7FYbmbyGyevI/wrj+qTerf9Wseg8x pLRIZFZy29xbW032iJboeQ8bptID4G4A+hwfwqrDJeagL9LZXSSSSNY4l+8YFBBVfX+A kDrjNXha2YUr5chB9WH+FK1tZtGsZibC9OR/hWssNKTuYQxsILl3KdzYXrWeo2tvDdyS rJbny1jJdRiTsBkf/Xp01zHINQFwJ7lkazjkaGUAmQI4Y7irA9MH1x1qVtPsGbcYpCfX cP8ACpFs7FXVxCwYd8j/AAqZYWcm3/XQ0jj6cY2S6WKEX2lLmyuNsotoLC5MjkZCZaYL k4xknAHrU2mC5ibTLa5V45o7RzJG4wyku5GR2OMGp5LGwlcu0L5P+0P8KltobW1JMMTA kEZJH+FOOFmp81/61/zJqY6nOm4W1/4YKKKK9E8UKKKKYBRRRQMKKKSkAtJRRTAKKKKA CiiigAooooASiiigYUUUUAJRRRQAUUUUDCiikoAKKKKACiiigYUlFFABRRRQAUlFFABR RRQMSilpKACiikoAKKKKBhRRSUAFFFFAwpKWkoAKKSigYUUUUAFJRRTGFFFJQAUUUUgE ooopjCkoooGFJS0lABRRRQMKSiigApKWkoGFFFFACUUUGgYlFFJ3oAWkoooGBpKWkoAK SlpKBhSUtJQMKKKKAEoNFFAxKKKKACkpaSmMKKKSgAooooGJRRRQMKQ0tJQAlFFFAxKK WkoGFFFJQAUUUlAwooooAKSlpKBhRR2pKACiiigYlFFFAwpKKKACiiigYUUntRQAUH6U cUdaACkpaPagYnTiiijigDqaKKKk8IKKKKACiiigAooooAKKKKACiijNABiiikoAXNFJ RQAUUUUAFFFFABRRRSAKKKKYBRRRQMKKKKACiiigAooooAKKKSgBaSiigAooooAKKKKA CiiigApKKKBhRRRQAUlFFABRRRQMKKKKACkoooAKKKKACiiigYlFFFABSUtFACUUUUDC iiigBKKKKACkpaSgAooooGJRRRQMKKKKACkpaSgApKWkoGFFFJQAUUUUDCkpaSgAoooo ASiiigYUlFFMYUlLSUAFFFJQMKKKKACkpaSgYUlLSUAFFFJQMKTvS0UAJRRRQMSiiigA pKWkoGBpKXtSUDCiiigBKKKKBiUUUUDCkpaSmAUlLSUAFFFFIYlFFFMYUlLSUAJRRRQM SlNJRQMDSUppKACkpaKBiUUUlABRRRQMKSlpKBhRRRQAlFFFAwpKWk7UAFFBooGFJS/S koAKSlooAKQ+1LSUDCiiigDqaK85orzfrv8Ad/Ex/sv+/wDh/wAE9Gorzmij69/d/EP7 L/v/AIf8E9Gorzmij69/d/EP7L/v/h/wT0aiu8hhiMEZMSElR/CPSn+RD/zyT/vkVP8A aH938f8AgGn9kf3/AMP+CcBSV6B5EP8AzyT/AL5FHkQ/88k/75FL6/8A3fx/4Af2R/f/ AA/4J5/RXoHkQ/8APJP++RR5EP8AzyT/AL5FH1/+7+P/AAA/sj+/+H/BPP6K9A8iH/nk n/fIo8iH/nkn/fIo+v8A938f+AH9kf3/AMP+Cef0V6B5EP8AzyT/AL5FHkQ/88k/75FH 1/8Au/j/AMAP7I/v/h/wTz+ivQPIh/55J/3yKPIh/wCeSf8AfIo+v/3fx/4Af2R/f/D/ AIJ5/RXoHkQ/88k/75FHkQ/88k/75FH1/wDu/j/wA/sj+/8Ah/wTz+ivQPIh/wCeSf8A fIo8iH/nkn/fIo+v/wB38f8AgB/ZP9/8P+Cef0V6B5EP/PJP++RR5EP/ADyT/vkUfX/7 v4/8AP7I/v8A4f8ABPP6K9A8iH/nkn/fIo8iH/nkn/fIo+v/AN38f+AH9k/3/wAP+Cef 0V6B5EP/ADyT/vkUeRD/AM8k/wC+RR9f/u/j/wAAP7J/v/h/wTz6ivQfIh/55J/3yKPI h/55J/3yKPr/APd/H/gB/ZP9/wDD/gnn1Feg+RD/AM8k/wC+RR5EP/PJP++RR9f/ALv4 /wDAD+yf7/4f8E8+or0HyIf+eSf98ijyIf8Ankn/AHyKPr/938f+AH9k/wB/8P8Agnn1 Feg+RD/zyT/vkUeRD/zyT/vkUfX/AO7+P/AH/ZP9/wDD/gnn1Feg+RD/AM8k/wC+RR5E P/PJP++RR9f/ALv4/wDAD+yf7/4f8E8+or0HyIf+eSf98ijyIf8Ankn/AHyKPr/938f+ AH9k/wB/8P8Agnn1JXoXkQ/88k/75FHkQ/8APJP++RR9f/u/j/wA/sn+/wDh/wAE89or 0LyIf+eSf98ijyIf+eSf98ij6/8A3fx/4Af2T/f/AA/4J55RXofkQ/8APJP++RR5EP8A zyT/AL5FH1/+7+P/AAA/sn+/+H/BPPKK9D8iH/nkn/fIo8iH/nkn/fIo+v8A938f+AH9 k/3/AMP+CeeUV6BNDEIJCIkBCn+EelfPlUsdf7P4/wDAJlldvt/h/wAE9Dorzyin9d/u /iL+zP7/AOH/AAT0KivPaKPrv938Q/s3+9+H/BPQqK89oo+u/wB38Q/s3+9+H/BPQqK8 9oo+u/3fxD+zf734f8E9Borz6ij67/d/EP7N/vfh/wAE9BpK8/oo+u/3fxD+zf734f8A BPQKK8/oo+u/3fxH/Zv978P+CegUV5/RR9e/u/iH9m/3vw/4J39FcBRR9d/u/iH9m/3v w/4J31FcDRR9e/u/iP8As7+9+H/BO+orgaKPrv8Ad/EP7O/vfh/wTvaK4Kij67/d/EP7 O/vfh/wTvaK4Kij67/d/EP7O/vfh/wAE7yiuDoo+vf3fxD+zv734f8E7ykrhKSj67/d/ Ef8AZ3978P8AgneUlcJRT+vf3fxD+zv734f8E7uiuEopfXf7v4h/Z/8Ae/D/AIJ3dJXC 0UfXf7v4h/Z/978P+Cd1SVw1FH13+7+I/wCz/wC9+H/BO5orhaKf17+7+If2f/e/D/gn c0Vw1FH17+7+P/AD+z/734f8E7mkrh6KX17+7+P/AAA+of3vw/4J3FJXEUU/r3938f8A gD+of3vw/wCCdvRXEUUfXv7v4h9Q/vfh/wAE7ekriaKPr3938Q+of3vw/wCCdrRXFUUf Xv7v4j+of3vw/wCCdrSVxdFH17+7+IfUP734f8E7SiuLoo+u/wB38f8AgB9R/vfh/wAE 7OiuMoo+vf3fx/4A/qP978P+CdlRXG0UfXv7v4/8APqP978P+CdlSVx1FH17+7+P/AD6 j/e/D/gnYUVx9FH17+7+P/AD6l/e/A7CiuPpKPr3938f+AP6l/e/A7CiuPoo+vf3fx/4 AfUv734HX0VyFFH17+7+P/AH9S/vfgddRXI0UfXv7v4/8APqX978DrqSuSoo+vf3fx/4 AfU/734HW0lcnRR9e/u/j/wB/U/734HWUVydFH17+7+P/AD6n/e/A6uiuUoo+vf3fx/4 AfU/734HVGiuVoo+vf3fx/4A/qf978DqqSuWoo+vf3fx/wCAH1T+8dTSVy1FH17+7+P/ AAA+qf3jqaSuXoo+vf3fx/4A/qnmdRRXL0UfXv7v4/8AAD6p5nT0GuYAJOAMmr8miavE 6JJpV6jSZ2BrdwWwMnHHPFH17+7+P/AD6p5mxRXNrDK0LzLE5iQgM4U7VJ6An3wanuNN v7W3S4ubG5hhfG2SSJlVs8jBIwaPr3938f8AgD+q+ZuUVzNFH17+7+P/AAA+q+Z0tH41 zVWodNvZ7Ge+it3NrBjzJeijkDHPU8jgetH17+7+P/AD6r5m1RWLc6be2lpb3VxbtFDc Z8pm43Yxzjrjkc96euk3z2H21IleHAJ2yqXAJ2glAdwGeM4o+vf3fxH9V8zXorI1DSb7 TVRruEIrsVBWRXwwxlTtJwRkcHBqjR9e/u/j/wAAPqvmdLSGuboo+vf3fx/4AfVvM6Si uboo+vf3fx/4AfVvM6TvSGucoo+vf3fx/wCAP6t5nR0n0rnasP8A8g+H/rrJ/JKPr393 8f8AgB9W8xtFFFecbHTv4C16KFZbiKCBWkjiw8oJy7hR93PdhW1b/Cy8b/j51SGP/rnG X/mRXXa3DrIsY/Mv7Fl+1W2Atm4OfOTB/wBaeM447+3WtDyNc/6COn/+AL//AB6ouzXl R4BRRRVmR9Cwf8e8f+6P5VJUcH/HvH/uj+VSEhQSSABySayOgzZNRupbmWHTrJbgQttk klm8tA3XaDgkkd+Me/Wp9PvheCVHiaC4hbbLE5BKnGQQR1BHQ/1yKyNK1NbZLn/RLuSz kuJJbe4hgaQSBm3HhckfMSASMEYINaGmRzS3t3qM0LQCdUjjifG4Im4gtjoSXPHoB9KA NKqJ1nSg+w6nZ7s42+euc/nV6sqQM3ibarbWNiQGHY7xzR1DoatFYEWp3c8ChZdstvay Pc4Uf6wZUDpxyrH8BT4rm9t/7NnmvDcC7G2SLYoAOwtlMDP8Pcnr2oA3KaZEWRYy6h2y VUnk464FYOl3mrXb2l2YbjyJ/mkV/JESoQSCuDvyOOvXngdrWpxyy6zpyRTmElJcuqgs BhemcjP1BoA1qK5pdUv5VtrRPPkmLTCSWBYg7CN9owHIUZyCf0HpYSXVZJLG1mmktXk8 3e22MuyqRtPGVBweccdfwAN2iudivtVu5mnt4bkxrcGMJ+5ERRW2kkk788E8e3B73PEM Ty2ttsuJIf8ASYh8gU5y49Qen+c0dg7mtRWOpvL24vI49Qkt1tGES4RCXbaGLNkHjnoM dD+FmC6urvQUu4ET7VLb70U/d3lcj8M0eYF+iucbUrmO3jgimvJ7qWcROskcayw/KWOP uocgcHkc9+lTC6vorN47pruKR5gluQkTTSDGSMLlB0PJwMfnQBu0VzsV9qEtusJmkilF 99nLyJGX2FN3IXK557eg96twG8vLy5jW/liS0dYhhEJlO0MWbK984+XHf8D+v6+8DVSR JASjqwUlTtOcEdRTq5qOS6tI5rtLoiIaiYzAEXaytJtOSRnPOeCBx0rpaFtcOoUUUUAF FFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUARz/8AHvJ/un+VfPNfQ0// AB7yf7p/lXzzVxM5hW5pnhue8sft9zdQWFnnas1w2Ax9AO/4Vh11HjfzN2lbM/YfsSeR j7uf4/xz1/CqIRT1Pw3PZWP2+2uoL+zzhprdshT6Edqw66jwR5m7Vd+fsP2N/Pz93P8A B+Oen41y9AMKKKKACte50CeO6ljgvNPmiVyEl+3QLvUHhsF+MjnFZFdhq9zr8usXslnr 6i2eeRogusRqNhY7cDzOBjHFAIwZtMjgmhimvoNz28kzmN1kVGXftTcrEEttXv8Axjj1 za7az1jUbDVbOVLq3u75dLmWZ5ZftA+V5ZcFlbrtVR14BriaBsKKKKBBXeQ+BIZIUcm5 yyg8SJ/hXB17Q9+lna24ZSxZB0+grhxftW4wpN3d9joouCTlPZHIv8OpGYmPUFRT0V0y R+INZXiDwhLomnfbHvEmG8JtCEdfx9q77+3Iv+eT1jeOrhbnwqsiggGZev41nF4unKKq qybt0HehNPkep5rRRRXpHMFdDpGlII0mnTzJHwVQjOK56vRdH2NqFvtx0Oz/AHtp2/ri sK13aKdrm2Hr06NVOorrX7xV0a9cBBbLkj/Vl1Df98k5rD1zwxcxW0l5HbeWIxl1BGMe uM1rAz/aQAH8/d77t3+NdbfNHsm83GzZ+89Onzf1rLMaTy7knCV79DspY545ShOCVjxK iiiu080K2tG0xJUFzcLuU/cU9D71i12+h+SYtP8AMx5QKb/pxn+tYV21GyNaFanSqxdV XRdh0i7aNQlsqKw+VWZUJ+gJBrO1bwpdyRPJHaeXKgJIBX5vbGa0b7zxfzCfd5u85zXU qX+zW/m583yl35659/wxWWYUHgKca0JXud1LMHjHKlOCseJHikq1qhjOq3hix5fnPtx6 bjiqtdUXdJnmtWdgoooqgCiiigAooooAKSiigAooooAKKKKACiiikAUUUUwCiiigAooo oAKKKKQBRRRTAKKKKACiiigAooooAKKKKACiiigApKWkpAFFFFMYUUUUAFFFFABRRRQA UUUUAFFFFABRRRQAUUU+GMzTRxBkUuwUM7BVGT1JPQe9ADKK6D+0tM03/iXQWsd9aNxd TsMPMfWM9UC9vXv6VlanawWt0FtbpLm3dQ8bjrg9mH8LDuP6EUhjbGwuL95FtxH+6TzH aSVI1VchclmIHVgPxq3J4e1CJgsj2KMVDANqFuDgjIP3+hBB/GrXgy9a01+KFWmRrwx2 wlhkCNHmVDu5Ugj5cEEcgkU7WtN13VNSe7/sPVF3JGn72J5HO1FXLNtGSduScd6AMy60 m7tLU3Mht3hDiMtDcxS4YgkAhGOMhT+VUa3JdOv7DwvefbbK4tt95b7POiZN2EmzjI56 j86Z4az5175P2T7X9nH2b7V5e3f5sfTzPlzt3e/WgCjcaZfW01tDNayLLdIskMeMs4Yk DAHPJHTrTZ7KaCzgum2mOYsox1VlPKt6HkH6EV0l353mW39qf8fP9mz7/O/1vm+fLs25 53b9vTnGe2ai8QZ+wX/mY8z7Xbb8f89fIbzv/H8ZouBzUP8Ark/3hXf3FtJa+Obi8jsL 22yLgi4lOY5D5bEFPlGPzNee0UWBHf6e2nyad/az+Ulrc39u1xGT8sUg3b8j+7yG+hx2 rF1XTbiHSL281FbyK8a6UbpJP3VzncdyjHOB3BPWuaoosO4UUUUxBWppMscen6uryKrS WwVAxwWPmIcD14BrLooA6DTruODTtKxfraSRXkztIE8wxAqmGKd+hqbS5EsdHuJmezjd lWSKWOdWllcOGEbxkkhcjJIC/dHJrmaKVgOn8R3Vp/ZKwRxxx3NxdtdSJHdLcKuRj7yj Ayc4HJGOTzXL0UUDCiiimItaZafb9UtLLzPL+0TJFvxnbuYDOO/WrPkaF/0EdQ/8AU/+ PUeGf+Ro0n/r8h/9DFZlIZsQafpN2ZY7bUbwzLDLKoks1VTsRnIJEpxkL6GsetPw/wD8 hGX/AK87r/0nkrMoAKsP/wAg+H/rrJ/JKr1Yf/kHw/8
Sep 27, 2024 17:39:58.085475922 CEST	49733	587	192.168.2.6	79.170.44.32	.
Sep 27, 2024 17:39:58.575185061 CEST	587	49733	79.170.44.32	192.168.2.6	250 OK id=1suD4X-00000001qX9-41te
Sep 27, 2024 17:40:00.770937920 CEST	49733	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:40:01.155379057 CEST	587	49733	79.170.44.32	192.168.2.6	221 mta2.hi.local closing connection
Sep 27, 2024 17:40:01.745645046 CEST	587	49734	79.170.44.32	192.168.2.6	220 mta3.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:01 +0100
Sep 27, 2024 17:40:01.745814085 CEST	49734	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:40:01.928118944 CEST	587	49734	79.170.44.32	192.168.2.6	250-mta3.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:40:01.934931040 CEST	49734	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:40:02.126339912 CEST	587	49734	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:40:02.541647911 CEST	587	49734	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:02.542953968 CEST	587	49734	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:02.547091961 CEST	49734	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:40:02.741941929 CEST	587	49734	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:40:02.742157936 CEST	49734	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:40:02.927963972 CEST	587	49734	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:40:02.928164005 CEST	49734	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:40:03.111082077 CEST	587	49734	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:40:03.158596039 CEST	49734	587	192.168.2.6	79.170.44.32	.
Sep 27, 2024 17:40:03.697834015 CEST	587	49734	79.170.44.32	192.168.2.6	250 OK id=1suD4d-0000000DSRw-06wq
Sep 27, 2024 17:40:09.441814899 CEST	49734	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:40:09.826637983 CEST	587	49734	79.170.44.32	192.168.2.6	221 mta3.hi.local closing connection
Sep 27, 2024 17:40:10.403703928 CEST	587	49735	79.170.44.32	192.168.2.6	220 mta2.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:10 +0100
Sep 27, 2024 17:40:10.405220032 CEST	49735	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:40:10.587929964 CEST	587	49735	79.170.44.32	192.168.2.6	250-mta2.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:40:10.589364052 CEST	49735	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:40:10.770076990 CEST	587	49735	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:40:10.960524082 CEST	587	49735	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:10.969430923 CEST	49735	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:40:11.150280952 CEST	587	49735	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:40:11.154901028 CEST	49735	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:40:11.338866949 CEST	587	49735	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:40:11.346343994 CEST	49735	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:40:11.528137922 CEST	587	49735	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:40:11.584883928 CEST	49735	587	192.168.2.6	79.170.44.32	.
Sep 27, 2024 17:40:12.076889992 CEST	587	49735	79.170.44.32	192.168.2.6	250 OK id=1suD4l-00000001qhf-1rv0
Sep 27, 2024 17:40:12.578613043 CEST	49735	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:40:12.961359978 CEST	587	49735	79.170.44.32	192.168.2.6	221 mta2.hi.local closing connection
Sep 27, 2024 17:40:13.539604902 CEST	587	49736	79.170.44.32	192.168.2.6	220 mta3.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:13 +0100
Sep 27, 2024 17:40:13.539757013 CEST	49736	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:40:13.723359108 CEST	587	49736	79.170.44.32	192.168.2.6	250-mta3.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:40:13.727281094 CEST	49736	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:40:13.920830011 CEST	587	49736	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:40:14.115984917 CEST	587	49736	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:14.122153044 CEST	49736	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:40:14.343787909 CEST	587	49736	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:40:14.354110956 CEST	49736	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:40:14.540555000 CEST	587	49736	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:40:14.541599989 CEST	49736	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:40:14.722503901 CEST	587	49736	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:40:14.752588987 CEST	49736	587	192.168.2.6	79.170.44.32	.
Sep 27, 2024 17:40:15.269901991 CEST	587	49736	79.170.44.32	192.168.2.6	250 OK id=1suD4o-0000000DSaN-2gbn
Sep 27, 2024 17:40:16.631124020 CEST	49736	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:40:17.013740063 CEST	587	49736	79.170.44.32	192.168.2.6	221 mta3.hi.local closing connection
Sep 27, 2024 17:40:18.138073921 CEST	587	49737	79.170.44.32	192.168.2.6	220 mta4.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:17 +0100
Sep 27, 2024 17:40:18.138887882 CEST	587	49737	79.170.44.32	192.168.2.6	220 mta4.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:17 +0100
Sep 27, 2024 17:40:18.139851093 CEST	587	49737	79.170.44.32	192.168.2.6	220 mta4.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:17 +0100
Sep 27, 2024 17:40:18.743961096 CEST	587	49738	79.170.44.32	192.168.2.6	220 mta4.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:18 +0100
Sep 27, 2024 17:40:18.744189978 CEST	49738	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:40:18.924895048 CEST	587	49738	79.170.44.32	192.168.2.6	250-mta4.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:40:18.925079107 CEST	49738	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:40:19.116219044 CEST	587	49738	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:40:19.301363945 CEST	587	49738	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:19.301526070 CEST	49738	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:40:19.483355999 CEST	587	49738	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:40:19.483519077 CEST	49738	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:40:19.668325901 CEST	587	49738	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:40:19.668535948 CEST	49738	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:40:19.849189997 CEST	587	49738	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:40:20.377511978 CEST	587	49738	79.170.44.32	192.168.2.6	250 OK id=1suD4t-00000001Xyv-3DRo
Sep 27, 2024 17:40:37.293031931 CEST	49738	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:40:37.679230928 CEST	587	49738	79.170.44.32	192.168.2.6	221 mta4.hi.local closing connection
Sep 27, 2024 17:40:38.289328098 CEST	587	49739	79.170.44.32	192.168.2.6	220 mta1.hi.local ESMTP Exim 4.97.1 Fri, 27 Sep 2024 16:40:38 +0100
Sep 27, 2024 17:40:38.322160006 CEST	49739	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:40:38.514791965 CEST	587	49739	79.170.44.32	192.168.2.6	250-mta1.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:40:38.516573906 CEST	49739	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:40:38.717248917 CEST	587	49739	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:40:38.929620028 CEST	587	49739	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:38.929810047 CEST	49739	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:40:39.121254921 CEST	587	49739	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:40:39.121426105 CEST	49739	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:40:39.325959921 CEST	587	49739	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:40:39.326101065 CEST	49739	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:40:39.523607969 CEST	587	49739	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:40:40.094321012 CEST	587	49739	79.170.44.32	192.168.2.6	250 OK id=1suD5D-0000000CadD-1pUm
Sep 27, 2024 17:40:45.535448074 CEST	49739	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:40:45.922365904 CEST	587	49739	79.170.44.32	192.168.2.6	221 mta1.hi.local closing connection
Sep 27, 2024 17:40:46.938390017 CEST	587	49741	79.170.44.32	192.168.2.6	220 mta3.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:46 +0100
Sep 27, 2024 17:40:46.938580036 CEST	49741	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:40:47.121237993 CEST	587	49741	79.170.44.32	192.168.2.6	250-mta3.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:40:47.121423960 CEST	49741	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:40:47.306278944 CEST	587	49741	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:40:47.492809057 CEST	587	49741	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:47.495131016 CEST	49741	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:40:47.678412914 CEST	587	49741	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:40:47.678800106 CEST	49741	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:40:47.865405083 CEST	587	49741	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:40:47.865540028 CEST	49741	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:40:48.056315899 CEST	587	49741	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:40:48.642755032 CEST	587	49741	79.170.44.32	192.168.2.6	250 OK id=1suD5L-0000000DSuz-43oU
Sep 27, 2024 17:40:56.590215921 CEST	49741	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:40:56.985843897 CEST	587	49741	79.170.44.32	192.168.2.6	221 mta3.hi.local closing connection
Sep 27, 2024 17:40:57.699666977 CEST	587	49744	79.170.44.32	192.168.2.6	220 mta4.hi.local ESMTP Exim 4.98 Fri, 27 Sep 2024 16:40:57 +0100
Sep 27, 2024 17:40:57.699873924 CEST	49744	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:40:57.880464077 CEST	587	49744	79.170.44.32	192.168.2.6	250-mta4.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=100 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:40:57.905774117 CEST	49744	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:40:58.086604118 CEST	587	49744	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 17:40:58.270159006 CEST	587	49744	79.170.44.32	192.168.2.6	235 Authentication succeeded
Sep 27, 2024 17:40:58.275254965 CEST	49744	587	192.168.2.6	79.170.44.32	MAIL FROM:<info@fasmacopy.gr>
Sep 27, 2024 17:40:58.455923080 CEST	587	49744	79.170.44.32	192.168.2.6	250 OK
Sep 27, 2024 17:40:58.456265926 CEST	49744	587	192.168.2.6	79.170.44.32	RCPT TO:<info.superseal@yandex.com>
Sep 27, 2024 17:40:58.663965940 CEST	587	49744	79.170.44.32	192.168.2.6	250 Accepted
Sep 27, 2024 17:40:58.664109945 CEST	49744	587	192.168.2.6	79.170.44.32	DATA
Sep 27, 2024 17:40:58.846858978 CEST	587	49744	79.170.44.32	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2024 17:40:59.383275986 CEST	587	49744	79.170.44.32	192.168.2.6	250 OK id=1suD5W-00000001YMG-3CLV
Sep 27, 2024 17:41:08.425247908 CEST	49744	587	192.168.2.6	79.170.44.32	QUIT
Sep 27, 2024 17:41:08.816617012 CEST	587	49744	79.170.44.32	192.168.2.6	221 mta4.hi.local closing connection
Sep 27, 2024 17:41:09.424382925 CEST	587	49745	79.170.44.32	192.168.2.6	220 mta1.hi.local ESMTP Exim 4.97.1 Fri, 27 Sep 2024 16:41:09 +0100
Sep 27, 2024 17:41:09.424503088 CEST	49745	587	192.168.2.6	79.170.44.32	EHLO 019635
Sep 27, 2024 17:41:09.609002113 CEST	587	49745	79.170.44.32	192.168.2.6	250-mta1.hi.local Hello 019635 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Sep 27, 2024 17:41:09.609680891 CEST	49745	587	192.168.2.6	79.170.44.32	AUTH login aW5mb0BmYXNtYWNvcHkuZ3I=
Sep 27, 2024 17:41:09.795674086 CEST	587	49745	79.170.44.32	192.168.2.6	334 UGFzc3dvcmQ6

Target ID:	0
Start time:	11:36:57
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe"
Imagebase:	0x16b9e610000
File size:	3'814'016 bytes
MD5 hash:	62E11691C457A43738B01FACA500F688
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2193066300.0000016BA085E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2193573310.0000016BB0D09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:36:58
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0xdc0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4618642160.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4619850731.000000000309B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4619850731.000000000309B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:36:58
Start date:	27/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2544 -s 1060
Imagebase:	0x7ff69a130000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD3468E395 Relevance: 13.8, Strings: 9, Instructions: 2533COMMON

Download Yara Rule

Strings

YL_H, xrefs: 00007FFD3468E48E
SL_H, xrefs: 00007FFD3468EA8E
$t4, xrefs: 00007FFD3468F563
$t4, xrefs: 00007FFD3468E463
$t4, xrefs: 00007FFD3468EA84
$t4, xrefs: 00007FFD3468EA63
$t4, xrefs: 00007FFD3468F584
$t4, xrefs: 00007FFD3468E484
HL_H, xrefs: 00007FFD3468F58E

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $t4$ $t4$ $t4$ $t4$ $t4$ $t4$HL_H$SL_H$YL_H
API String ID: 0-1112332321
Opcode ID: b54d20491109a85423b7f087e0cb8b0fe28ba69638195e681d3e352b3a1cb29f
Instruction ID: 03b9525101fa2f684aba51ace1e7d547483ef61dae0463235590dccd9e02477b
Opcode Fuzzy Hash: b54d20491109a85423b7f087e0cb8b0fe28ba69638195e681d3e352b3a1cb29f
Instruction Fuzzy Hash: 8C03453160CB554FD399DF28C4A04B5B7E1FF96301B1446BEE58AC72A6DE38E846C782

Function 00007FFD34750186 Relevance: 4.7, Strings: 2, Instructions: 2237COMMON

Download Yara Rule

Strings

st4, xrefs: 00007FFD34750321
A, xrefs: 00007FFD34750786

Memory Dump Source

Source File: 00000000.00000002.2196692693.00007FFD34750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34750000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: A$st4
API String ID: 0-489307662
Opcode ID: 43ae90cd2f63c657c7b637112b339e33e85fa38e98362799a54df448ef1252da
Instruction ID: f0705a891969c2a9544f1d601bd781ef22319b92751cf66ed8e5febea4b50c84
Opcode Fuzzy Hash: 43ae90cd2f63c657c7b637112b339e33e85fa38e98362799a54df448ef1252da
Instruction Fuzzy Hash: 9CE207B2A0D6C58FEB56DB2888A55A47BE0FF57300F1805FED589CF192DA297807C781

Function 00007FFD346833D0 Relevance: 4.5, Strings: 3, Instructions: 747
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[W4, xrefs: 00007FFD34685030
d, xrefs: 00007FFD34684D5F
Hoq4, xrefs: 00007FFD3468501E

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Hoq4$d$[W4
API String ID: 0-1929143951
Opcode ID: 06e061b0c416e78db274f07ad1309eb24b6bc0e40bb5d3786a883b541e89858e
Instruction ID: c954900303a8f604e0fca062124b5d0f1002f4c18ccadbb445d5f85f1e0d0ddc
Opcode Fuzzy Hash: 06e061b0c416e78db274f07ad1309eb24b6bc0e40bb5d3786a883b541e89858e
Instruction Fuzzy Hash: 1D225431B0CA4A0FE798DF2894E55F177D0EF96314B1442BAD59EC7197EE28F8428381

Function 00007FFD346845F0 Relevance: 4.2, Strings: 3, Instructions: 452
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFD34684660
]V4, xrefs: 00007FFD346846A0
hKq4, xrefs: 00007FFD34684724

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ]V4$fish$hKq4
API String ID: 0-659341052
Opcode ID: bd09b868121aead126832dd9064c71412d35993e825a548a2f1719997d026871
Instruction ID: 980ca59d72c335344bb851e9436bd0e3c60ca009e7d755a849c357d7fccda150
Opcode Fuzzy Hash: bd09b868121aead126832dd9064c71412d35993e825a548a2f1719997d026871
Instruction Fuzzy Hash: 14C12931B1CA5A0FE79DAE2898B55F577E1EF96314B04017ED18BC31D2EE1DA8428741

Function 00007FFD3468BA69 Relevance: 3.0, Strings: 2, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$t4, xrefs: 00007FFD3468BC62
$t4, xrefs: 00007FFD3468BCE0

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $t4$ $t4
API String ID: 0-1608043427
Opcode ID: 1a266791125cdd357536b043ab8c3bc628945055e18345b8efe16cf057f9bbaf
Instruction ID: 8abf796761867bc83d6c56f4bc36f9ad20de94d71aab8ba18c723795df3d82d8
Opcode Fuzzy Hash: 1a266791125cdd357536b043ab8c3bc628945055e18345b8efe16cf057f9bbaf
Instruction Fuzzy Hash: CBE1593160CBA64FE35DCF2484A51F1B7E2EFD2701B1446BEE5E6C7296DD28A406C781

Function 00007FFD34689770 Relevance: .9, Instructions: 915COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1017eab8ac5c2807ba6b7a5510f40e3f7208edafd50002e5e16e6a8ad95302e9
Instruction ID: efdea4ca6608c11ab6b29670650a59e03ea8a8a88518d86f311e5abc8a4c2ee2
Opcode Fuzzy Hash: 1017eab8ac5c2807ba6b7a5510f40e3f7208edafd50002e5e16e6a8ad95302e9
Instruction Fuzzy Hash: AC420671A0DBD64FD7968F2888A10B17BE0EF53310B1945FAC1DAC7193DA2DB84ACB51

Function 00007FFD34683BE9 Relevance: .7, Instructions: 696COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbff8233feb0a35d069b12bdaf64684aa48a8b3d9a7e31383194c317ef630e53
Instruction ID: d9ff10d12dc893a9536e8e28e84f31c12419bc80f7fb120f5826c3768d8540fc
Opcode Fuzzy Hash: dbff8233feb0a35d069b12bdaf64684aa48a8b3d9a7e31383194c317ef630e53
Instruction Fuzzy Hash: 88126831B0CA6A4FE7599F6898E52F977D1EF92311F14417ED08EC3193EE2D68829341

Function 00007FFD34694A55 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8abe660f37681500618d64258ec9d88a64251575a9e89517b1941425859f36
Instruction ID: 3718ba5526de5d4d8a899c7527c4f97e63a445e82f279f2b9055af0b17793336
Opcode Fuzzy Hash: ee8abe660f37681500618d64258ec9d88a64251575a9e89517b1941425859f36
Instruction Fuzzy Hash: 11516B31B0D7590FE72DDE68C8A61B57BE5EB42310B05827FD58BC7297DC28A8478381

Function 00007FFD346831B9 Relevance: 1.6, APIs: 1, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD34683261

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7717f2b8fd5197d80ad8e500d1d8b2f61b87b53292a6468dc716bca4f39ba23b
Instruction ID: 4d603fb4016e07c636d40db665502e4093af732c2c6b0d779057c14ae8c7deee
Opcode Fuzzy Hash: 7717f2b8fd5197d80ad8e500d1d8b2f61b87b53292a6468dc716bca4f39ba23b
Instruction Fuzzy Hash: 40310531A0CA5C8FDB18DF9CE8556F97BE1EB96321F04426FD049D3192CB656846CB81

Function 00007FFD347501A2 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

st4, xrefs: 00007FFD34750321

Memory Dump Source

Source File: 00000000.00000002.2196692693.00007FFD34750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34750000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: st4
API String ID: 0-386899768
Opcode ID: 4804c7735c87d6ba83d7133d6d2bb484c63b25ec7533ba44579956158c775345
Instruction ID: 1bd25f6bab3148a0afe5bbd951d56424e03c560ab7c6a42ee8f999ec544208bb
Opcode Fuzzy Hash: 4804c7735c87d6ba83d7133d6d2bb484c63b25ec7533ba44579956158c775345
Instruction Fuzzy Hash: 77610671A0CA89CFDB59DF18C8A55A87BE0FF56304F1402FEC14ACB192DA29B847C781

Function 00007FFD347510C9 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196692693.00007FFD34750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34750000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9609b20498dd094c1906217971236512aa4a63d5742ec0a34b2ca6dadfdc30ba
Instruction ID: 86fc74de5ae0ed2b7c2f84a4a25be4c749bb4e7fc8e20879f527350a9d756ab6
Opcode Fuzzy Hash: 9609b20498dd094c1906217971236512aa4a63d5742ec0a34b2ca6dadfdc30ba
Instruction Fuzzy Hash: AB411976E0D6C98FEB46EA14C8E14A87BA0FF56305B0501EAD459CF193DA19B846D3C0

Non-executed Functions

Function 00007FFD346884D3 Relevance: 16.8, Strings: 13, Instructions: 588COMMON

Download Yara Rule

Strings

L_^ , xrefs: 00007FFD34688512
L_^, xrefs: 00007FFD34688A62
L_^Y, xrefs: 00007FFD3468856A
L_S, xrefs: 00007FFD34688965
L_^, xrefs: 00007FFD3468876A
L_^, xrefs: 00007FFD3468896A
L_^, xrefs: 00007FFD346886CA
L_^, xrefs: 00007FFD346885C9
L_^, xrefs: 00007FFD34688A22
L_^, xrefs: 00007FFD346889C2
L_^P, xrefs: 00007FFD34688562
L_^, xrefs: 00007FFD34688AC2
L_^, xrefs: 00007FFD346887C9

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^$L_^$L_^$L_^$L_^$L_^ $L_^P$L_^Y$L_S
API String ID: 0-4108938417
Opcode ID: 8ba1a6a019cea8f543f166ffe04f884c7a926b1070ec6bacc42279f9f8fdaeca
Instruction ID: 02075636296838d4702e49bb217de3c4feb06da018a8680c951ec016ecf9e759
Opcode Fuzzy Hash: 8ba1a6a019cea8f543f166ffe04f884c7a926b1070ec6bacc42279f9f8fdaeca
Instruction Fuzzy Hash: BF12E763F0D2920BE7516BEDA8B50FB7B94EF5232CB0C11B6C2DC9A183ED1C744A4685

Function 00007FFD346828FA Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196450332.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafcbaf1cb81cbe6cbe5ded94ffeac5b2975fe1d49c5789bcdf75e7d5126cb5f
Instruction ID: 0eb60661b6c5d7638af8f945ed9a791449715dd97b002a9ee7468a25668b5a56
Opcode Fuzzy Hash: fafcbaf1cb81cbe6cbe5ded94ffeac5b2975fe1d49c5789bcdf75e7d5126cb5f
Instruction Fuzzy Hash: B691333160CA5D4FEB54EF6CE8916F93B90FF92325F04427BD48EC6192CE28A4468B91

Analysis Process: InstallUtil.exePID: 5804, Parent PID: 2544COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	43
Total number of Limit Nodes:	6

Executed Functions

Function 06B355B8 Relevance: 1.9, Strings: 1, Instructions: 603
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06B35C55

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: b89cdc5871d81e8ebcdb907517474a6ad6e1178b2c40db0100b607d57d143cf0
Instruction ID: 174d8d0b7b4e28572347d00b51b5d73da0a6e70bd3830694bcb287e62825285a
Opcode Fuzzy Hash: b89cdc5871d81e8ebcdb907517474a6ad6e1178b2c40db0100b607d57d143cf0
Instruction Fuzzy Hash: 9D22B176F002659FDF60DBA4C8806AEBBB6EF85310F2485A9D945EB341DB35DC42CB90

Function 06B36608 Relevance: .8, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fdebb590383c7b9c03ba01b295cb132aef30191c877813a78db3a6cf780587
Instruction ID: 12a0d0f5f9b3043ca1524dacb5b6c43dff9a973b568bf5c98c15c1de7225ddf5
Opcode Fuzzy Hash: a1fdebb590383c7b9c03ba01b295cb132aef30191c877813a78db3a6cf780587
Instruction Fuzzy Hash: 78629C74B002259FDB54DB68D584BADB7B2FF88310F1485A9E806EB350EB75ED42CB90

Function 06B3C198 Relevance: .6, Instructions: 642
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 345b93c94e2f3b4d6ea9fa2e3e4266093e557ed32940a65a09ab08bae5a4ce4d
Instruction ID: 5f715a29d9fad2a442aa7f260928046a26a18081f7f4f25d0ec79b1cf4672b9d
Opcode Fuzzy Hash: 345b93c94e2f3b4d6ea9fa2e3e4266093e557ed32940a65a09ab08bae5a4ce4d
Instruction Fuzzy Hash: 4C325D74B002158FDF54DFA8D880AAEBBB2FB88310F149569E905F7351DB78EC468B94

Function 06B3B24B Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d51f59404b02e0f23b0d4311718487abf98176d73dcc5ac8bf56c1c36924607e
Instruction ID: 335ddb30141de652bfb4134f557555c5a6fc660e8f521cd3ab2563cf407d2362
Opcode Fuzzy Hash: d51f59404b02e0f23b0d4311718487abf98176d73dcc5ac8bf56c1c36924607e
Instruction Fuzzy Hash: DB2273B0F001198BEF64CBACD4907AEB7B6FB95310F205569E505DB39ADA34DC41CB91

Function 06B33068 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361311c2885e96bbb1775fe231dc5a380777c02f92a526ab415d65604b485501
Instruction ID: 1bd4e370e21e0d5f8095df406f386d32783a6b21e20e5bb19cdab5124c930f29
Opcode Fuzzy Hash: 361311c2885e96bbb1775fe231dc5a380777c02f92a526ab415d65604b485501
Instruction Fuzzy Hash: 52323D30E1065ACFDB14DFB4C89059DB7B6FFC9300F6096AAD409AB214EB74AD85CB94

Function 06B3A3C8 Relevance: 2.7, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X!@, xrefs: 06B3A438
x!@, xrefs: 06B3A459

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID: X!@$x!@
API String ID: 0-2527372166
Opcode ID: 228b1777ce245e4557518f94f72a8f873138b55664d1f903fd3a221694cdac65
Instruction ID: 02d49137641175b31f391125ab8e38088a98e7e8d8bf72ee25af166e50656083
Opcode Fuzzy Hash: 228b1777ce245e4557518f94f72a8f873138b55664d1f903fd3a221694cdac65
Instruction Fuzzy Hash: 0081AE71B002159FDF54DFA8E8906ADB7B6FF88310F2085B9E51AE7340EB359D468B90

Function 016FEB08 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4619649726.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9679fa0787438de23c8330772f3540dfe66724ad161f6eb902144f45c83ac325
Instruction ID: 170b6283b33d63b6aa223fb320ed6d384ad11208e043efb16ce309d16e7bfd34
Opcode Fuzzy Hash: 9679fa0787438de23c8330772f3540dfe66724ad161f6eb902144f45c83ac325
Instruction Fuzzy Hash: 6C414272D043998FDB00DFB9D8002EEBFF5AF8A210F0581ABE604A7351DB749844CBA1

Function 016FEC00 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 016FEC67

Memory Dump Source

Source File: 00000002.00000002.4619649726.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e2052ce55a4bdfb225db0b7de69ab9ba5b2f3fdd6e90f51b92ce707911ec16be
Instruction ID: b33810656c1b045e70065770331b250dd25f53be65108ca1b33c740e17755275
Opcode Fuzzy Hash: e2052ce55a4bdfb225db0b7de69ab9ba5b2f3fdd6e90f51b92ce707911ec16be
Instruction Fuzzy Hash: C01114B1C0065A9FDB10CF9AC544B9EFBF4AF48620F11812AE518A7240D378A950CFA1

Function 06B32349 Relevance: 1.0, Instructions: 1007COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7cf8eb33f1eec751aac827eab1c4c5bdbe501c2c7c12b6a4a748f4f449706c9
Instruction ID: 97966a16c98089b2c73b4c36f3fbe3cbbff6a00b61ac0ea5cae4426b2c858498
Opcode Fuzzy Hash: d7cf8eb33f1eec751aac827eab1c4c5bdbe501c2c7c12b6a4a748f4f449706c9
Instruction Fuzzy Hash: 9B922274B00225CFDB64DF68C584AADBBF2FB85314F5484AAD409AB361DB35ED85CB80

Function 06B3CF58 Relevance: .8, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1856b5f4b8870b78ee3f8e9d178384fb6e04382b83a4de5e8b532db7aa3d7b
Instruction ID: 98e4bc8126db68c28e02a6a976f09e029944a7732be00fd0358386ce40cbdf0e
Opcode Fuzzy Hash: ba1856b5f4b8870b78ee3f8e9d178384fb6e04382b83a4de5e8b532db7aa3d7b
Instruction Fuzzy Hash: 3D621970B00216CFDB55EF68D990A5EBBB6FF84300F609A68D105AB355DB79EC46CB80

Function 06B3B668 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22fb3a441cea1a65c0c7d8c27fce00adb7afb366fe9126ed4778a371164684c1
Instruction ID: aef7ec899a5222c20615e85659e7ef8707db7b4b0f635374ee5d930406c9261b
Opcode Fuzzy Hash: 22fb3a441cea1a65c0c7d8c27fce00adb7afb366fe9126ed4778a371164684c1
Instruction Fuzzy Hash: 7E026C70F002298BEFA4CF68D4807ADB7A2FB95310F1095AAD415EB249DB75EC41CB91

Function 06B3ACF0 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833076ade8185cda8dbb914f41635ec73352459ac2190de031db083557305346
Instruction ID: 26e3fd9cd3efe25fedd58dedada61c60aa8bf517a063777b74c11eedf0736646
Opcode Fuzzy Hash: 833076ade8185cda8dbb914f41635ec73352459ac2190de031db083557305346
Instruction Fuzzy Hash: F3E18F70F1021A8BDF54DF68D8906AEBBB2FF88300F209569E805EB355DB749C46CB91

Function 06B38090 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90eab58849274f1643744cb14ccf4099a1ea13d9107ac4b824e42378f02bcab7
Instruction ID: 9e4437c3d2499caba0acf2fdec9fbe064b439b2c4baa1e8df81e08fff323bf47
Opcode Fuzzy Hash: 90eab58849274f1643744cb14ccf4099a1ea13d9107ac4b824e42378f02bcab7
Instruction Fuzzy Hash: 83917070B012168BDB64DF69D8906AE77A6FF88200F108568E805EB354EF78DC468BD1

Function 06B39170 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d980aa12c6021f57728f71abb7f184ffc55a2fcc158d726753cee2c41b00931d
Instruction ID: 31c37c2b32b1dd8dce2506f0b7ddb5bfe253936ce55e20444d509721877c1349
Opcode Fuzzy Hash: d980aa12c6021f57728f71abb7f184ffc55a2fcc158d726753cee2c41b00931d
Instruction Fuzzy Hash: A7913D70F0125A8FDB54EF69D890BAEB7B6FFC5200F1085A9D40AAB344EF749C418B91

Function 06B36208 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb4089ef1689f01d733e8e252d434590e8c387636b4f964b1872e7f283461d2
Instruction ID: bb888aca2f27af8163caddf8d26d97777b8d1454c45484864834738c1d37bc38
Opcode Fuzzy Hash: dcb4089ef1689f01d733e8e252d434590e8c387636b4f964b1872e7f283461d2
Instruction Fuzzy Hash: 7A61A2B1F001614BDF549A7DCC8465FBADBEFC4220B15447AD90ADB364EEA5EC0287D1

Function 06B345C8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ae743620dbe3a1b3ee574bfc31739d81636a892e67658ebd3b6d2ba65cc522
Instruction ID: 4a4316d75ea1f68a55cb218c9cb1e8aebe397f3925080eb10b65050e46961ff6
Opcode Fuzzy Hash: 78ae743620dbe3a1b3ee574bfc31739d81636a892e67658ebd3b6d2ba65cc522
Instruction Fuzzy Hash: E4913D70E1025A8FDF60DF68C850B9DB7B1FF89310F208699D549AB295DB70AA85CF90

Function 06B342B6 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ffaf52da3d6b3a791676dd5cc8c88536ac5e65539fc82dd195db116a687a6b
Instruction ID: 1f42f6e0ec8de55f67ef31bd55afce1a36679f1bfc8ae21f8cd165a64c4067bb
Opcode Fuzzy Hash: 73ffaf52da3d6b3a791676dd5cc8c88536ac5e65539fc82dd195db116a687a6b
Instruction Fuzzy Hash: BF812674B0125A8BDF54DFA8D4946AEB7F2EFC9300F108569D50AEB394EB34DC428B91

Function 06B3801D Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7495d3f83c3ffd921d6d916e9c8a79ae3588b410b51c1a83ad76940022d36437
Instruction ID: 8a4c6f9d42511ec9a712d2c5bb918935ba1049a43277de46d21f35d44dd9a5f0
Opcode Fuzzy Hash: 7495d3f83c3ffd921d6d916e9c8a79ae3588b410b51c1a83ad76940022d36437
Instruction Fuzzy Hash: 23710170B01225CFDB54DB64D894AAEB7B2FF88310F24C599E515AB391CB35EC42CB91

Function 06B3A680 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66045320d890b797bb67ee71c82707a13d9bb4fb76ab30979b4aa2a8d85f422f
Instruction ID: 7f81930315fdd10c8647d684ae32528784e5803d121744c3d59d4a725621839d
Opcode Fuzzy Hash: 66045320d890b797bb67ee71c82707a13d9bb4fb76ab30979b4aa2a8d85f422f
Instruction Fuzzy Hash: FA718E747002568FEB54DF24E880BADB7E6FB88700F208579E941A7391DB79EC42CB94

Function 06B345E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07add8e2f9a27283a17a55e59ca56bc0f8ec0c6d14496e1f2f63d3034c445d5e
Instruction ID: 050067383d08294a5f9ac21242146b97382036bfc00ad536663a4feac8c23cc6
Opcode Fuzzy Hash: 07add8e2f9a27283a17a55e59ca56bc0f8ec0c6d14496e1f2f63d3034c445d5e
Instruction Fuzzy Hash: 46912D70E1061A8BDF60DF68C890B9DB7B1FF89310F208699D549BB355DB70AA85CF90

Function 06B3EB2A Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb9c84f5ac99349d4719f075a72bb853c1ed78e1feae8cf661e5bd3933f1844
Instruction ID: bd61ce6b22b26288865d27d06f18d893598fe76e7cf3df8fcd3cac6a53f0d50a
Opcode Fuzzy Hash: acb9c84f5ac99349d4719f075a72bb853c1ed78e1feae8cf661e5bd3933f1844
Instruction Fuzzy Hash: 7B711970B002199FDB54DFA9D980A9EBBF6FF88300F24846AE405AB355DA74ED46CB50

Function 06B3EB38 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2569232e5cd023c87fc9e0a7e4021b6143a36c4f3234ed100aef7dfe3ddeceaa
Instruction ID: 40eb08fedcbe1bf2ad4982764f44afebef52e68ee6824825516bae8fe6e604c7
Opcode Fuzzy Hash: 2569232e5cd023c87fc9e0a7e4021b6143a36c4f3234ed100aef7dfe3ddeceaa
Instruction Fuzzy Hash: 56711B70B002199FDB54DFA9D980A9EBBF6FF84300F24846AE415EB355DA74EC46CB50

Function 06B34B78 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3ed937c62b41259426d2d15e594d851cb3abcce23e66a8a55df3aef410852a
Instruction ID: 015d7903828505c9c759cbff7cf7cb4046694732f7b6df73deda247ec7e83c18
Opcode Fuzzy Hash: 7d3ed937c62b41259426d2d15e594d851cb3abcce23e66a8a55df3aef410852a
Instruction Fuzzy Hash: C9614C70F002199FEF559BA8C8547AEBBF6EB88300F20846AD506AB395DB754C45CB94

Function 06B3FC99 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd5fa7b95ee441f77bd4a9a9262d31ac9deb3cc79fa30dd6838a911b687ad3d
Instruction ID: 694ef9b5f5618076caad3231f99e3b998686d580e3ffb3da3c2488f45967a1dd
Opcode Fuzzy Hash: 7bd5fa7b95ee441f77bd4a9a9262d31ac9deb3cc79fa30dd6838a911b687ad3d
Instruction Fuzzy Hash: 9851DFB1F10225DFDF54AFB8E8886BEBBB6EB84311F1048A9E106D7251DB358C55CB90

Function 06B3FA4A Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2119108a17790edaf76fe8fee7d3aa2b416788d24c43f53bcec9ee71fb71f9
Instruction ID: 63ea97d6759454bd5b03578dab422408170838591af7d9e2042746b15a0ce546
Opcode Fuzzy Hash: fb2119108a17790edaf76fe8fee7d3aa2b416788d24c43f53bcec9ee71fb71f9
Instruction Fuzzy Hash: 1C5180B0F202149BEF645ABCD85477F7A6ED789350F20547AE50AD7392CE6CCC4583A2

Function 06B3FA58 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a17adbc76d84949be86bbecb3b2bf2462488b0be22d4fd830f82ce663cbf5aaa
Instruction ID: 40d960ffa100c3057ab84bbfc7bf842e14f87a629b6098e53c16a7a2bde45217
Opcode Fuzzy Hash: a17adbc76d84949be86bbecb3b2bf2462488b0be22d4fd830f82ce663cbf5aaa
Instruction Fuzzy Hash: C5517CB0F102259BEF645ABCD85473F7A6ED789350F20547AE50AD7392CEACCC4583A2

Function 06B39161 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415e8a295f439582f7a0f00067e6002f96cd453c3b08a93b21bb2c55849873f4
Instruction ID: 8454d6c4739a8cb099523641bd95f210e4e0634aa79d916ae0990f77ac7d808d
Opcode Fuzzy Hash: 415e8a295f439582f7a0f00067e6002f96cd453c3b08a93b21bb2c55849873f4
Instruction Fuzzy Hash: BC514F70B011569FEB54EF78D890BAE73F6FFC5200F1485A9D40AEB384EA749C418B94

Function 06B34B68 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6252978af62ce483e426098a140568c43a30eaf07cb3fe2a69317b81e873bd30
Instruction ID: 893d60b086e96f14d4f70cd632e3bd7461664bcd7769116997a37bbcae2f430a
Opcode Fuzzy Hash: 6252978af62ce483e426098a140568c43a30eaf07cb3fe2a69317b81e873bd30
Instruction Fuzzy Hash: 79514B70F002199FDB549FB5C854BAEBBF6FF88300F20856AE506AB395DA758C05CB94

Function 06B35428 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b12b4db735d6ba9c165af43679030d70031d686c774b621259e446f0bf6ae6
Instruction ID: 4f57307241ec4c692ce0060eb667868f5d5e58698befaea1ec6ecd7ad9edb981
Opcode Fuzzy Hash: 60b12b4db735d6ba9c165af43679030d70031d686c774b621259e446f0bf6ae6
Instruction Fuzzy Hash: 6D417BB2F006198FDF70CEA9D880BAFBBF2EB94310F10496AD256D7654D331E9558B90

Function 06B3DACD Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307ca892b70e5078d18602f3d60a31f940fc8f15ec47081b619c7eaa2e168937
Instruction ID: 3f287d5f43a34fce7f8ddd0ad6ac018f422f16daa5c41e64d0e09d1366aec65e
Opcode Fuzzy Hash: 307ca892b70e5078d18602f3d60a31f940fc8f15ec47081b619c7eaa2e168937
Instruction Fuzzy Hash: 6D41A1B0F1025ADFDB65DF75C89469EBBB6FF85300F244969D402EB240EB749846CB80

Function 06B321D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18454a5960649d3b7e528273e5371ff9187938ddb0efa84ebcf57569562af9d3
Instruction ID: 2ff5ab5e7473ca28075b4f794c4016c53370b374014d98160715b9b10d7b49b0
Opcode Fuzzy Hash: 18454a5960649d3b7e528273e5371ff9187938ddb0efa84ebcf57569562af9d3
Instruction Fuzzy Hash: 2031DA30B102168FDB58AB78CD5066F3AA7EF89240F2054ACD402DB385EE39CD01CBE4

Function 06B355A7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee8f2d95a0fd9794170f7447d66b3b0f75e1a6750a18c7f380d68688f4e8c27
Instruction ID: 58722b87eff2cd0838da808688a234da7cfa2d2d42f314e729a2774822a14b68
Opcode Fuzzy Hash: fee8f2d95a0fd9794170f7447d66b3b0f75e1a6750a18c7f380d68688f4e8c27
Instruction Fuzzy Hash: C431A4B2F002559FDF70DEA9C890B7FBBB2EB85310F2488AAD549D7251C635D841CB91

Function 06B32080 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a34852a0d5088d01bcfac977d0c225526b5be6aadd5508e61dd12fa33e7073
Instruction ID: 8860f5ac23840065341b34cbe88e81a61891a03ec03ea62b54500d9328afa209
Opcode Fuzzy Hash: c7a34852a0d5088d01bcfac977d0c225526b5be6aadd5508e61dd12fa33e7073
Instruction Fuzzy Hash: 7C31AD70F106269FDB59DF64D89469EB7B2FF89300F10846AE906E7340EB71AD42CB80

Function 06B32090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7008224125ad469e0e5b46bda983fcc74bd84ebeb83280bccaa1a2d47f950852
Instruction ID: ad79ea2afa0c4b8e9dbf65fd1ada05a8853c812fafc3aa02a22d54a47b182253
Opcode Fuzzy Hash: 7008224125ad469e0e5b46bda983fcc74bd84ebeb83280bccaa1a2d47f950852
Instruction Fuzzy Hash: 3B31AC70F0062A9FDB19DF64D89469EB7B2FF89300F10846AE906E7340DB71AE42CB50

Function 06B33AA8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7645c466a33682fe2d150ada87038f37e921199c6bca465e108b1c54929d6f71
Instruction ID: 7866e26e64e3c4840cc8dbaa6668e90ef593f2c826e70275b0d67319583e0a23
Opcode Fuzzy Hash: 7645c466a33682fe2d150ada87038f37e921199c6bca465e108b1c54929d6f71
Instruction Fuzzy Hash: 29217A75F11619AFDB40CF69D840AEEBBF6EB88310F104069E905E7350E738D8418BE4

Function 06B33AB8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e1573f7eea1c8443275294c358129494497916ec2f5128cbd9219368a35b39
Instruction ID: 4626ada7655edf9fb2f6cf4aa8af77bfc7f6f7d71be7ef909537e3c7ea0b560a
Opcode Fuzzy Hash: 13e1573f7eea1c8443275294c358129494497916ec2f5128cbd9219368a35b39
Instruction Fuzzy Hash: CF218E75F016559FDB40CF69D880AAEB7F5EB88310F104069E905E7340E738DC408BA4

Function 016AD1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4619492147.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae35326a149d5233095aa137f0a22a6487c8b81f168d718c99fe2bda2ae9bb9
Instruction ID: fe3b4f2d25988b17db4f6e4b03ac8325fe1239f210326d9f9b50aae53ccf56e0
Opcode Fuzzy Hash: 3ae35326a149d5233095aa137f0a22a6487c8b81f168d718c99fe2bda2ae9bb9
Instruction Fuzzy Hash: 822134B1504200EFDB15DF94D980B2ABB65FB84324F60C56DEA090B746C376D806CEA1

Function 016AD3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4619492147.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6cb37596205a26c3c2c3b29ef645543083a94b77bfdb42de5d64896af7729e
Instruction ID: ba7014bcc2cc335747b30441bd8838112934c4b865d826f83ecadd49948fbe10
Opcode Fuzzy Hash: 8e6cb37596205a26c3c2c3b29ef645543083a94b77bfdb42de5d64896af7729e
Instruction Fuzzy Hash: F42122B5604204EFDB05DF54D9C0B26BBA5FB88314F60C5ADD90A4B752C37AEC46CE61

Function 016AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4619492147.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf90f1feec7fb3d4e5cff87d8d540775d41385d1b48b3f99d755f8815e661d1
Instruction ID: 90b3a51b72ac6438bd44842447e2926d0b34aa7a223d2e63708d31290f7132a6
Opcode Fuzzy Hash: fbf90f1feec7fb3d4e5cff87d8d540775d41385d1b48b3f99d755f8815e661d1
Instruction Fuzzy Hash: F12130B1144200EFCB14DF58D980B26BBA1EB84314F60C56DD90A0A792C37AD847CE62

Function 06B3A670 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bb74d6353cc3467d5a32f1b9f349f7383221bc99d1afd91612b6bca7670d0b
Instruction ID: 4e462ce903dbea8e1d8ac431ff2e3f7250f501dc51ea1d4b1581aa1c404a6ba5
Opcode Fuzzy Hash: 91bb74d6353cc3467d5a32f1b9f349f7383221bc99d1afd91612b6bca7670d0b
Instruction Fuzzy Hash: 3011E171F001199BDF04DAACE8916DEB7AAFB89214F108579D409F7241EA36AD018BE5

Function 06B36D30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283143c1b0d19acebfa89fdd7539a9a54b9897b82aff5e6b54674eb91bb9b253
Instruction ID: bd33e89a216979e803d72e84b7a394855de115069c1c2d2194bf948ac10a90c9
Opcode Fuzzy Hash: 283143c1b0d19acebfa89fdd7539a9a54b9897b82aff5e6b54674eb91bb9b253
Instruction Fuzzy Hash: 3121AFB0B10129ABDF84DA69E8906AEB7B6EF85310F248479D405EB350EB35AD418B94

Function 06B33BC8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f735cab5b15c18ea29ea3f1bb2f4f95f2db6113b9fa82d91fb67d3883c3925
Instruction ID: 3dad06a0e17c9dd07267ceb41990571c6a9e4f23d28416061f55138c1c7d11b9
Opcode Fuzzy Hash: a4f735cab5b15c18ea29ea3f1bb2f4f95f2db6113b9fa82d91fb67d3883c3925
Instruction Fuzzy Hash: 3011A136B101694FDB949A7DD8146AF73EAEBC8310F00447AD806E7354EE29DC018BD0

Function 06B3A328 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945fc579468bcfb61a817a4d9ee35c6fd6caa9281306eae96cc616b908222d99
Instruction ID: 56b9ab4a4eec88db79f99c35182819c05a7220083e5c9bb7fde5ed91383d5b28
Opcode Fuzzy Hash: 945fc579468bcfb61a817a4d9ee35c6fd6caa9281306eae96cc616b908222d99
Instruction Fuzzy Hash: 3F01D470B006202FDB619A7CE8507ABB7DAEB8A710F208479E54AC7391DE29EC0247D5

Function 06B34208 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a23bc4ae312758a2f80c05257bd4df9a26c7c202bf9c8f064260d8a508986f8
Instruction ID: 1a401a836ebe37bcced3c7232246355aa9724fe2c42b24f7b404da44a3d067b2
Opcode Fuzzy Hash: 3a23bc4ae312758a2f80c05257bd4df9a26c7c202bf9c8f064260d8a508986f8
Instruction Fuzzy Hash: FF014771B141200BEBA185BCAC1472A77DBDBC9720F14887EE10AD7386EDA6CC028391

Function 06B33BB8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629d730961ef3b296f29005fc0355ce947ddc6e49f0e30aa49e228383df2a10d
Instruction ID: b9ae62d1c6cf636e8b0b432ef88ae260a821a5da232c07574062adbb7101f385
Opcode Fuzzy Hash: 629d730961ef3b296f29005fc0355ce947ddc6e49f0e30aa49e228383df2a10d
Instruction Fuzzy Hash: 7401D436B140656BDB54956DDC106EFB2EAEBC9710F00447AD506E7394EE248C0147E2

Function 016AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4619492147.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 553be8ef69db7331f6d2c5a11c5ecc64a3aaaace4a03c09db09bc77474d1ed29
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 9511A975544284CFCB12CF58D980B15BBA1FB84214F28C6AAD8494BB66C33AD84ACF62

Function 016AD1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4619492147.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction ID: ed3badba9162b7386444786b11e955766d1a3dcbefef8faa35861bac7d8075e5
Opcode Fuzzy Hash: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction Fuzzy Hash: 5E118B76504284CFDB12CF54D984B19BB61FB84224F24C6AAD9494BB56C33AD80ACFA2

Function 016AD3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4619492147.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 2f5e72a2598f6442829cc9a565495eb99001bef809bdb3d15593a39367b4a150
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 4A11BEB5504280DFDB02CF54D9C4B55BB61FB84314F24C6AAD9494B766C33AE84ACF92

Function 06B33880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aaa523afc1a412a9914611103b496c6cbd5b3448a52a55dc4941e07ebec11a7
Instruction ID: 328ef875f94b89ad667b60b7984b66d2b1c084b4a4d4efa74d46a72d2eb2e61b
Opcode Fuzzy Hash: 3aaa523afc1a412a9914611103b496c6cbd5b3448a52a55dc4941e07ebec11a7
Instruction Fuzzy Hash: EF21C0B1D0125ADFDB10CF9AD984ADEFBB4FB48214F10825AE518B7201D3B46554CBA5

Function 06B33888 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965d8ccdd49d38b89b63a4a43f3eee06f3c5c1e4b9ea97a75312678ff6da2082
Instruction ID: acee43909ba715c74cb1def70f6d2b2fa317a001e57cd3bfb6ca117572b88e0a
Opcode Fuzzy Hash: 965d8ccdd49d38b89b63a4a43f3eee06f3c5c1e4b9ea97a75312678ff6da2082
Instruction Fuzzy Hash: 3D11C2B1D01259DFCB00CF9AD884ADEFBB4FB48314F10812AE518A7200C3746554CBA5

Function 06B3EDA9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d8022065182d17a7e34da0104c71ad9afe2e03412103100fed28c2e1bc5d5b
Instruction ID: 111f2a2bfed8e0a58183d1af6cd61f9b53a2a44d955044b723872f1b7ad05ad7
Opcode Fuzzy Hash: b6d8022065182d17a7e34da0104c71ad9afe2e03412103100fed28c2e1bc5d5b
Instruction Fuzzy Hash: C9018F71B102214BDBA5AA7C9854B2B73DAEBC9614F148C7BE50AC7340EE65EC034781

Function 06B3FEEB Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304bdc7ae7c17737c38a1dafeaafbb4b3d30b4639d044356508831911ed0c58a
Instruction ID: c72169b4f29b5e6e857ceefd70418c4df0a9f8a2e9d8993fd383c19a12aa5ecf
Opcode Fuzzy Hash: 304bdc7ae7c17737c38a1dafeaafbb4b3d30b4639d044356508831911ed0c58a
Instruction Fuzzy Hash: E801C471B0A3859FCB919FB8E8506AE7FB5EB45204F1041F6D904E7257DB384805C792

Function 06B34218 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba679a59933a4b0a9e18dbfdfc78c44e6085e0d106b3873c1737c8ddbd6a430
Instruction ID: 0df1b0406d1a34d3d533c4411ceca731a2c3c7e0fd554c085d1c7dd031814df4
Opcode Fuzzy Hash: dba679a59933a4b0a9e18dbfdfc78c44e6085e0d106b3873c1737c8ddbd6a430
Instruction Fuzzy Hash: 03018171B201211BEFA495BDAC5572FB7DAEBC9720F24983EE10AD7344EDA5DC024391

Function 06B3EDB8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb98de6fb87f82180d08d51a699f207b7bd45c1d99e6031146bf9735a496c54
Instruction ID: 675f50ed33b5127125d055868357afccc9f65afbfc20b94d7eeeb9da95c01de4
Opcode Fuzzy Hash: ceb98de6fb87f82180d08d51a699f207b7bd45c1d99e6031146bf9735a496c54
Instruction Fuzzy Hash: EA01AF71B101224BDFA5AA7CA894B2F72DAEBC9710F10987FE50AC7340EE65EC034391

Function 06B3A338 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d17243db2504133f398567194f4f2a27263aba1605c1b156f3c72542161aa7
Instruction ID: c175afadb441bd42fe38f32d3de326aebf06c38e497704c804bd2ef7c0c44087
Opcode Fuzzy Hash: a8d17243db2504133f398567194f4f2a27263aba1605c1b156f3c72542161aa7
Instruction Fuzzy Hash: 98013170B001215BDB659A6CE85076EB3DAEB86B10F20887DE50AD7340EE29EC0247D5

Function 06B3AF40 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7efef9dec92dad076fbe77365908ff94c5f722f56ebf5299c9c1d0c43846fda
Instruction ID: 5b400fc76481dd270eb65b1d0f7192cf4f9116c13a105285346665954f977a96
Opcode Fuzzy Hash: e7efef9dec92dad076fbe77365908ff94c5f722f56ebf5299c9c1d0c43846fda
Instruction Fuzzy Hash: 0801A9B1F003199BDF649A68D84479DBBA9EB85320F20487EE509E7380D675AC45C7D1

Function 06B3808E Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fecace026906590166fe7f44148a9bcc840525f9a8a4de9eaa764125e883035
Instruction ID: ffdbfac311afcf25bc7a63a69498d1a05ef7814eda9d2a9c9b7230f544a3b906
Opcode Fuzzy Hash: 7fecace026906590166fe7f44148a9bcc840525f9a8a4de9eaa764125e883035
Instruction Fuzzy Hash: 64F022B6B012348BEF644DA1DD812ABB36AEB84220F1044B6FD01F3240CA78ED09C7D2

Function 06B3FF08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4f8c79d9fb1fd62d8b877de466fff8dcea2ba04d00cde14c97a5b117a365ac
Instruction ID: 875692ee64d73414bd3206f485db5ae039e2ce486b0d671321cd1f0544310dac
Opcode Fuzzy Hash: 3c4f8c79d9fb1fd62d8b877de466fff8dcea2ba04d00cde14c97a5b117a365ac
Instruction Fuzzy Hash: E7F0FE74B022499FDB84EFB8D84026E7BEAFB84600F5041799909E7359EF789941CB91

Function 06B36488 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4626004788.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe154c9560a085761abf163dc52f3def7d6b19fb784fa7d71bd42e2a99e098a
Instruction ID: 5282e1d043c76cd43d58b16a97536524598fcfd49397bffa1b3e685a74110b7f
Opcode Fuzzy Hash: 5fe154c9560a085761abf163dc52f3def7d6b19fb784fa7d71bd42e2a99e098a
Instruction Fuzzy Hash: 67E0DFB2F24218BBDF50DE71DA0578B7BADDB46214F2054E5D448E7202FA3ACE41C7A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EP144UTC55LADQ1M_566591d2b953a70a81c6aa39397b5bad4c56aed_37c5cacb_1b37c6ba-e108-4c33-a97e-31b9def44dae\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF267.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3A1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3C1.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Windows Analysis Report
SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe

Function 00007FFD346833D0 Relevance: 4.5, Strings: 3, Instructions: 747
COMMON

Function 00007FFD346845F0 Relevance: 4.2, Strings: 3, Instructions: 452
COMMON

Function 00007FFD3468BA69 Relevance: 3.0, Strings: 2, Instructions: 463
COMMON

Function 06B355B8 Relevance: 1.9, Strings: 1, Instructions: 603
COMMON

Function 06B3C198 Relevance: .6, Instructions: 642
COMMON

Function 06B3A3C8 Relevance: 2.7, Strings: 2, Instructions: 238
COMMON

Function 016FEB08 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 016FEC00 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 06B3CF58 Relevance: .8, Instructions: 799
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre