silence-is-best · February 2, 2023 15:35
diff --git a/gistfile1.txt b/gistfile1.txt
 Date,Details,Email Payload Type,Users Targeted
 1/3/2023,ENQUIRY SO NO - 270; zip -> formbook,Attachment,15
 1/3/2023,Re: Fwd: PO EFT; img -> hta -> agenttesla,Attachment,2
 1/5/2023,Taxes; zip -> hta -> xworm,Attachment,3
 1/8/2023,RE:BL DRAFT SO# GOSUSNH1637860; zip -> formbook,Attachment,3
 1/8/2023,Payment Advice-BCS_ECS9522022121320540019_16334_952; doc -> agenttesla,Attachment,2
 1/9/2023,SHIPPING DOC (CI,COO,PL,BL); zip -> formbook,Attachment,3
 1/11/2023,Re: PO January Invoice_(Payment Confirmation); rar -> hta -> agenttesla,Attachment,2
 1/11/2023,RE: Purchase Order 8391-6; doc -> netwire,Attachment,3
 1/11/2023,Re: Fwd: PO_Invoice-Copy; rar -> hta -> agenttesla,Attachment,2
 1/11/2023,Re: Order 20230473 for week 3; zip -> remcos,Attachment,2
 1/11/2023,Re: Purchase Order (P.O.) No.4036041334; doc -> lokibot continued to 1/12,Attachment,3
 1/16/2023,NEW PO; img -> remcos,Attachment,3
 11/16/2023,Your Ultramar Invoice is Ready to View/Votre facture Ultramar est pr�t; one -> bat -> xworm,Attachment,22
 11/17/2023,FWD: Re: NEW ORDER (OUTSTANDING PO); doc -> agenttesla,Attachment,2
 11/18/2023,Shipment Document BL, INV and packing list; one -> asyncrat continued to 1/24,Attachment,3
 11/18/2023,Re: **TOP URGENT** Shipping Documents; doc -> agenttesla,Attachment,2
 1/21/2023,RE: Outstanding Account Statement For Very Well.; rar -> darkcloud,Attachment,3
 1/24/2023,Re: Purchase Order-23.01.2023; r05 -> agenttesla,Attachment,49
 1/25/2023,Re: find attached payment; xlsx -> remcos,Attachment,10
 1/28/2023,Bank Transfer from Us The chry sali sarchaeology; rar -> darkcloud,Attachment,2
 1/29/2023,FWD: check for payment urgently; xlsx -> remcos,Attachment,5
 1/29/2023,RE: Onquest China/Vietnam PO NBI_2300-123 / 35% Down Payment Terms; rar -> agenttesla,Attachment,2
 1/30/2023,Quotation Request; arj -> remcos,Attachment,3
 1/30/2023,RE: Payment; doc -> formbook,Attachment,2
 1/30/2023,Purchase Order with Price..; zip -> agenttesla,Attachment,4
 1/30/2023,RE: Processed payment; zip -> luminosity,Attachment,5
 1/31/2023,Request for quotation; xls -> formbook,Attachment,4

 agenttesla, 04263171f2d74a35541a07b05485709abd50d858deaf278f147a7557f9b2e76a, focuzpartsmart.com
 agenttesla, 0ebf4340d56b8018e2d6655311da863e7d3351ac9bda8438f2a42f51139d98a6, https://api.telegram.org/bot5249845718
 agenttesla, 14e7c7441ca7103c7cc9e96721342a7e60716c836f26a85037efdf6c7feae849, smtp.elec-qatar.com
 agenttesla, 1af68da9f45784f66b14b6760be4ab60486049e3aa41a8bbd35a95a1ef4faa1c, smtp.beckukk.com
 agenttesla, 1e61114dd0413c14225fd80ca645f3826d73c06319c71f24c29757c1cefaa163, mail.southernboilers.org
 agenttesla, 1e7690a67c8911298b510f2b12a46e26f906b657a89609b2ff4385c8a9f4878f, mail.biateknos.com
 agenttesla, 221a81d66ccd5492f313733aca66534af9350f427c50a6b30c7a65dce1ea0fbb, host39.registrar-servers.com
 agenttesla, 224695648fe70d6c4e2636192e87ab57d714d4a59188b331578f36758f23e318, smtp.beckukk.com
 agenttesla, 2299434f679982522b05bb2d725105b0d6adf6d8ab7b9c6c9b508eb50d26d99a, mail.sseximclearing.com
 agenttesla, 2827acabbd8a2d0213080c3cf3855db732799cabb5254bca6764734d16549b26, host39.registrar-servers.com
 agenttesla, 29ae2323ba55db42ad131386ef87f2748bc3fd98327b54a1bcc6378387494c8c, mail.elec-qatar.com
 agenttesla, 2f0ac14fdb816dc343425c23c4fd7f2ea5dfa93a547b57ff1402bc03adf7c800, focuzpartsmart.com
 agenttesla, 363b5b13158ff751910f1c9e250224792f690325f1d323546b70e5799c9da3cd, https://discord.com/api/webhooks/1060474967533301790
 agenttesla, 36856ffca1429da7e4a47d88ff8069505731d206666925eb996aca2abd09cad4, mail.elec-qatar.com
 agenttesla, 3bdbab28dae5e7dcaf32a879cfe9ef111eee48c76016a88f09bbebe547679041, https://api.telegram.org/bot2134979594
 agenttesla, 3d9bc90cfa2ddb3381b8e378d0e9f6f5f15e949fa4cfa469900720b17ba2578e, smtp.beckukk.com
 agenttesla, 3e22eae01de6d0f4b3a78b8fb15911270aa67f08233341c0fec84764b65a507d, smtp.elec-qatar.com
 agenttesla, 4795e398d5dce733ecb352580be08b33ae668684856a5cf34a8cc21fa303c60e, mail.strictfacilityservices.com
 agenttesla, 4e8d1a628ca70c4f5355d85722ba9f42d9a95dc14223d3892c89450e0a682669, mail.sseximclearing.com
 agenttesla, 4ec961389dcf825881ba0f1100d9ee32d5f7087e2337425d087fc0c5d768a990, mail.aquayflores.cl
 agenttesla, 50760724669f4ef9227085260826e8dd3b92aab51b2c5af925f283fbb741bceb, us2.smtp.mailhostbox.com
 agenttesla, 52ab9f2e3878dd9fa61c7bbbdfff113485fb4c12f8af0fa28b938696d68e54bb, https://api.telegram.org/bot5590596148
 agenttesla, 53d55a9c88eb76405269ee02a4c4818214be23b6793b348d817ebc764506e5af, mail.biateknos.com
 agenttesla, 564e748a2164cc70ec2c77d9830e301dedc3439f165fd8cc798bbd53fa168862, smtp.gmail.com
 agenttesla, 5984f06b2174c077939aef3eb600c56a03f35417e4c5add929d30345a6de428c, mail.abaexlogistics.com
 agenttesla, 5a7a08972825b0639cfb5645c0ee23a1acee08340223c7f5c7f015768ac77a18, mail.elec-qatar.com
 agenttesla, 5b8c0c56e48b1a5046c75da4416a009d3c9e00ab046223139551ba6c7126e4a7, mail.elec-qatar.com
 agenttesla, 5c879e5a07d1f6539515eb743a70d7b3ea22b3cd3ce1ff32cf6fb4a8447eaea2, mail.jackbarber.com
 agenttesla, 61f0682e81e51a2da57e9d2abd46efa24f920f3151757b5871db1932ff67de9b, mail.biateknos.com
 agenttesla, 6532e16d04ebfc98395b0e06fb2c1210d5064dc242c2c374beccb6b561a58f6f, cp5ua.hyperhost.ua
 agenttesla, 656b4aca18598d0fc4b53fa2585745d48498ced7d027e115643c7e50a5d92b9d, mail.qualitysolutions.co.in
 agenttesla, 67e8129c18c68670967b5957f52e9caa77fa896bfcaedd15996b9ca46cbdb686, mail.keefort.com.ec
 agenttesla, 6a0efe33cbf84ce5eef6931e1e05fcb20fbe87dbd4c621a0d1425f0412dad80c, nail.yantrika.com
 agenttesla, 6ba05012dc42370e27fe763cafdd4b4a09b0b198083199090dd1ff1856756d61, mail.qualitysolutions.co.in
 agenttesla, 72d186da41f7d6979ff9b012e4e5b5581da86946d60ffbc5870cc7b99dce192a, mail.sseximclearing.com
 agenttesla, 73f8f4b1fab2eeb0135f6207c88a0d5f7f8a5390ddd3f30403b7431ada2be289, us2.smtp.mailhostbox.com
 agenttesla, 7466aa2d482d74a4da0d1772009319a1507da78580178d9b2560586e53f99b74, mail.qualitysolutions.co.in
 agenttesla, 785d95955d4b6874b8af4dcfc1b75bcad1029ff37aeea13525cfd9295f1a5ee9, mail.southernboilers.org
 agenttesla, 7a5b7449fcd765f1a3be1dc0c8286cb46afe94b8c8040a0d268b27fe8d658ee4, smtp.gmail.com
 agenttesla, 7c388ef7f6f378929ecd8c0c32ecaca141cd21b5b9debd4b12ee5618fe0747d7, mail.sseximclearing.com
 agenttesla, 7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db, https://api.telegram.org/bot5590596148
 agenttesla, 87e32aa4c7cdad4872573c0d62e51e9256d1c774dbdebd2cb2e706734aa69e1f, mail.sseximclearing.com
 agenttesla, 8c61d194e68c94fcc2c577a5d61a697698c7aba068807c648e17ac4b93351dc2, mail.unrc.ir
 agenttesla, 8d95cc3446aa77c2e976b386b0acbd0dff59d19ef3a66619be28cd041376f582, focuzpartsmart.com
 agenttesla, 903cdb5e6c1c37c0934e99ab9e2db561273250fdd8a2cec152afb856a4f2b4cb, smtp.tvothaj.com
 agenttesla, 915cb8994b02a7d735b230b000ee1d7797500c5c0846b24103a9ad63956cbb41, smtp.elec-qatar.com
 agenttesla, 91f7c342ce163fe12c018a5068f921b5b78574cf05927bb85876be8484a2c237, https://discord.com/api/webhooks/1060474967533301790
 agenttesla, 944d12d7042e7f89a62aa636c97126aaf137425bf24e31974a282f6195cc584e, https://api.telegram.org/bot2134979594
 agenttesla, 971dfc5c82fae0d102f99d405119645d49629ab7679fe0d7eafeffeba4041d45, smtp.gmail.com
 agenttesla, 9b56ffabf61e4df4b774d198a6397b9ac6f431a59245b8400afa0b60bb017866, https://api.telegram.org/bot2134979594
 agenttesla, a53eafec588919d171746ba18abf11ca4643c9e2b858d3e825b5141946af0901, smtp.gmail.com
 agenttesla, a654440720fcdb36cc338da86c2c6beb922b3918c5341e168741a60a3d5ad2de, mail.strictfacilityservices.com
 agenttesla, aae65c255c24872651f5639421cfea382847382d50d40042cb931b7f7441d445, focuzpartsmart.com
 agenttesla, b0fdb78c68324224076f2d39061d3ad13c254e265a1842d87a6e7c8d49094e0e, smtp.elec-qatar.com
 agenttesla, b2eb6157f4c7092f16d815e898496e27da66b2a7b69639fee2eb707bd7237a62, api.telegram.org
 agenttesla, b6369635796fb8c318edbd1daa3d74816587157bf8b762c2d785ea7ccd10ad4c, host39.registrar-servers.com
 agenttesla, b6fcacde09c8e21c504ce0d553265a5fa7f5fabe0b7f8bb1ac8c62b6bf6de28e, smtp.beckukk.com
 agenttesla, cb4c05bf0a3cc9a2157b5b7799e3bdad472a0b677743ebb59803fa8934def97f, mail.jackbarber.com
 agenttesla, d07bee87efa9d63c230f1e4bb93dfcdec198e4ba69ca66e290d1e7bbc6f26078, focuzpartsmart.com
 agenttesla, d271d352cdd64384f1536695d0d0b281d23d79eae928c2491b87ec3f82422bf4, smtp.beckukk.com
 agenttesla, d4cf4250eb31e76e6468bc80f2768c42cf481696134beafc21739d987a36aa5e, https://api.telegram.org/bot2134979594
 agenttesla, d548bfcde55e09b8314b273b6fc1eff79563961b965cb83a763f4bb1b6c424ac, mail.goldismakina.com
 agenttesla, d8dcde33fb535be0d425f149fec9a6f686237c80dd6a1ed93c06fc973ef80a8d, smtp.beckukk.com
 agenttesla, dad8adf19a1adf3c1f83b948bf3866037d7a88e678fd6edf62a5c32ffe87565a, mail.strictfacilityservices.com
 agenttesla, e00c81eaf51d453c0a837df83d38b33cc4217bc40473a5a927c2434a1520a520, https://api.telegram.org/bot5249845718
 agenttesla, e134a17d9318e1460b4b352a30d64f417b01028e53ebdb151fd1edcfcbb1ab19, mail.clipjoint.co.nz
 agenttesla, e18b65850a6147b9ece9b7f2d8268303cdfa39c3c2ade801119f79191a6bc039, us2.smtp.mailhostbox.com
 agenttesla, e5b47dfdce0b43fbef23cf393838dffe7ea5173e73a783d881963e5b49b4f3d5, https://discord.com/api/webhooks/1061927100975681617
 agenttesla, e7ed6b0609943d4c6ddb3b032194d7fece3f9b5e2335f9ee0cbf4e1ba4b01efb, smtp.beckukk.com
 agenttesla, ea4684def9f3926d666c908edb9fa2646d33c2d84e7b502afbb987c5b2302cd7, mail.clipjoint.co.nz
 agenttesla, f2d560f960b4ab660621fef4d25d6b83b27da3deb53c1b0159c8abbc935a0ce4, mail.sseximclearing.com
 agenttesla, f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4, focuzpartsmart.com
 agenttesla, f8fa4a68488cfbb2c7130ee2637393f65e6a2585bf9171bcda0f0f7a7e4cffb6, https://api.telegram.org/bot5249845718
 agenttesla, f9eefe79d5efe2be33573c48777017ccdb97a3a1868628a8c2d8a207a03e67b6, focuzpartsmart.com
 agenttesla, fde6f4b70768e329b0d725843094cad8ee50638b32956c0edeefed2d551508d1, https://discord.com/api/webhooks/1061906591038844988
 agenttesla, fe867d208300886903bd50f715079f84291b6930c8b2aef827219b9689991f4f, mail.unrc.ir
 agenttesla, ffb64f4d42dd2de275cbf4ae7b334ffdd8920ff8fec95aca9900493472603d16, https://api.telegram.org/bot5590596148
 avemaria, c84447a3786502ee8e74208c08a2851720794669382eff06e874be595ecfe695, oneness.duckdns.org:8336
 darkcloud, 1716487b103dc267d5d1d0ad0f83565c11e3a18b0fd840f7b16893a14716b299, mail.krioncomputer.com
 darkcloud, 4848786ab1a4eb53f5bd0826c59c9620ea60e544b11e0d9183965fc0afe380de, [email protected]
 darkcloud, 93d81535630f75f9600b9a307dc2cd197f9f49361056cba8aa15cd5a4691831d, [email protected]
 darkcloud, b03225ede8b6ce37f12a6999260e06d0274ced375ac52294cae061a50dc61527, [email protected]
 formbook, 123e747239c973af2c8b7dc8a33b26fdc3cb05f2be8af864290f823daae7d764, http://www.2280400.online/ed9t/
 formbook, 139c10bab25d09231dfa465708c27632ed0618caaa710af0a1f326f80abd365b, adobeholidaylego.com/sk29
 formbook, 28ff484ca36b3a1f5d7f59a25e947e9a6b12ca34214f9bcfca01cee5745e6b6a, www.bilimmerkezleri.xyz/f649
 formbook, 2dac2db7d5d8e94a4eab1f98f30e282958a357eb496bfb2b9bd0fe532d8e0904, www.boltag.xyz/8qa3
 formbook, 492cabb55a2f649ce32194e8f9737a51f071b370bc9cd527aa8cd0b844ee7ea8, www.mon-coin-priere.store/umcs/
 formbook, 4ebe67fd893f6d8eb2a1bbb4ab73bea8c63a2741fc76b271cb1c9c05722a7dcb, http://www.chaatfunnnet.skin/ed9t/
 formbook, 5a125d1f8f0895426135345cf19d448fb3aaeacaa34eb055de6f2b89ac5dad17, http://www.capertidai.shop/f649/
 formbook, 5d40ae41d37143ffb8be9ec1d85563e3cd3b7def268abc33453b926d70a1aee7, www.bilimmerkezleri.xyz/f649
 formbook, 5ddfbe705b0cb87c996a1ebc61a337e8b5d187860c54c839cecf72a31ee375df, www.chaatfunnnet.skin/umcs
 formbook, 609e38239c20a1b1a2a1d773e18e467fb8097dcb2f398580c8780fc27d1df443, dupaxi.xyz/a09e
 formbook, 65c9f0517f21362d05bbc7361cf2fa89ae13933ac6f5d1c2092fff55795c20f3, www.primoilmio.bio/umcs
 formbook, 67388fca813133367167001c4114d6cd97b4bed24d0acdfda8b5784723a698ea, http://www.chaatfunnnet.skin/ed9t
 formbook, 67cc4306421a289d79bfd855c3da5e7ccbfe55e8eef44fc6c48aea748848ea5b, snowcrash.website/g2fg
 formbook, 6c7c0667c1f5d1832dac7b75704c408f0f48dbb7cd1e66550d92a873d9c50584, www.fatsecing.xyz/ippd
 formbook, 783dbf002227109a372c999fb01e0a6a542ff273dcb8a10e9080ba8d7466a6e8, www.dirdikyepedia.com/ed9t
 formbook, 7c530b0b55443db7e966b7420b27fb6ed79f8e70fc349fb00087f6d1e4b7cc25, www.dirdikyepedia.com/ed9t/
 formbook, 7ce7ca5deeb35f3cce19ca4e01e28aebe9f1b03dc8778a2e85e0d515a6df1a3e, fluidavail.online/oi05
 formbook, 7f284920214e53f8231f59b0ca2a804e41fb74ee8fd81b9ca86e6c39eadec7d2, www.paupocket.online/umcs/
 formbook, 81c0682751e0e809dc448f1bf8607a36c95840041de00cccd00032e066c6425e, www.dirdikyepedia.com/ed9t
 formbook, 82d7f1f5ad2b627a475ef42b781b92480b71f211491a363ad09c346fe0f3759e, http://www.chaatfunnnet.skin/ed9t/
 formbook, 87a8083bd4da6ab8f6b07927cd49581787ca70cdd9c2dee67de03682b3aa647d, www.bilimmerkezleri.xyz/f649
 formbook, a58a5f2c0f0ffae962702357f07665dbf49adc4c376aae50de4ce02745f3b06a, www.accordvent.xyz/f649
 formbook, bfc9cf8ef1369ba05191e708fea5b6c71d653dee922f15a53a7aed0642e1b756, http://www.chaatfunnnet.skin/ed9t/
 formbook, c18ffd59ba4e78061980e650dc6a2b6062f2829781ff7c061ba27f96cad60b5a, axie-connect.shop/gs12
 formbook, c33fd689aaab0c578d7569270d48b3c1fd9c9b28f45d81db6510326d0ddd0475, www.wanknumbers.co.uk/umcs
 formbook, d4a8cd1afe16b614f4edc31c747e1c62535fe24ee6fe0a7b8fbc6336d19562f8, www.ombqe.top/ed9t
 formbook, e2a0967cd49bb036d6f916e5cd1143d84e5c9de66c8674fd0a53caa2bc94ebe5, bellewayjewellery.com/gn92
 icedid, c06805b6efd482c1a671ec60c1469e47772c8937ec0496f74e987276fa9020a5, bloodfrakto.com
 lokibot, 4337ccc0329004c467b984ac20a8f86bf743a3e344900a6fadf4f73b2cfa0446, http://171.22.30.147/kelly/five/fre.php
 lokibot, 61a6189c8bf0e10eb20156d9c8847d3849d5307822ecea88bb3421835a347fb3, http://171.22.30.147/kelly/five/fre.php
 lokibot, 6f7d710effbef4c9dde9997af6ca7790d879e8e190b21bd5a43e099b27f6eb8a, http://171.22.30.147/kelly/five/fre.php
 luminosity, 36ce3b9ec0b50fcc219b1f1272363b8d3542b4afc3229e0251f58d9b27fb74e1, 185.17.0.79
 luminosity, 4cba59fde5a74d8e86638c65299b51adacc0ce2af56c1f17cb27c13bf5bb2263, 185.17.0.79
 luminosity, 9d58b6f6afb9a8237df181b9d0e1a250d122acd5d36208a3d2d7368bb9d25984, 185.17.0.79
 luminosity, aa4046ab8b9a2566c1a35d827ed97ce8f15e0254727d270807505f47d53aaeff, 185.17.0.79
 luminosity-agenttesla, 4a41861a81e4b094f22b2660ed6d0717892209452061d6c21668051651fe1763, mail.strictfacilityservices.com
 luminosity, bc6c1ee2b06d35ebb30a7ee02c682c6b72e5b3101cfb47e551301d2cfdc74ac7, 185.17.0.79
 luminosity, d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5, 185.17.0.79
 luminosity, e8ce64f1b350b774fe7f3704083b2f13bfe49ce8c50fec7580935f21b77e7257, 185.17.0.79
 luminosity, f01102bc0d4dd2e2508bcf195df1e52fe46afeba7b079cd7d9f51007ed9b6141, 185.17.0.79
 luminosity, fb8fdb08cf7984a3bac0cc7daeea3790a92306467543cf556945fc479a165dd8, 185.17.0.79
 modiloader-remcos, c266fa606a35b4ede65ae441e448dfcbf63b7a4e52091be0a6dc013b3e93c1f8, www.christopherferr.com:2404
 netwire, 0bcaaad38d8ff5881dae662a481b5f64bfeb71a40bf27d61a35889e7667ce44a, shevy.duckdns.org
 netwire, 467ef57122a909dadc6824af7c479e429cbd53428edece7472eec5993c2568d6, oneness.duckdns.org:3368
 origin, bfb963f003ea24be47ad11eddee613145bb6a470df3cee4579a50921d0a40797, https://discord.com/api/webhooks/1060474967533301790/
 purecrypter-remcos, 85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b, 194.180.49.17:28282
 purecryptor-agenttesla, 850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92, http://198.98.55.114/rights/inc/0b221f05c8d6c3.php
 purecryptor-remcos, f00982603a693995cf32649df28ac390ce839638751f04d11517454466061785, 194.180.49.17:28282
 remcos, 3ed1bebb7391002ffe104a9ffc9b0bf7fde5b42e3b5f798a6b02597775ebbf84, craigjonson1.gotdns.ch:2011
 remcos, 5a50e256c8ae0438325bcb04dc81fdac53d190ed1c818a00a770ae5f475cf522, 185.225.74.148:2404
 remcos, 6657f32b062ee72c7fbc5be2b486461a0e9b89d8115c87545248381e5bb96a8b, 194.180.49.17:28282
 remcos, a223dbd3e666c66e48d38bbc2e552a39bbfeb5f8b1663cdfa1d4a28543980c79, craigjonson1.gotdns.ch:2011
 remcos, a94e0b7244482530e7d071dad070b7801b5229d578b036dbf11ed1c854ed4690, 194.180.49.17:28282
 remcos, c0a5183fb178f4734580069f8697419dd8883a88bf69e57a2edb109d15d5cc9d, 195.133.40.168:54345
 snakekeylogger, 123a37dd6f535f44b95cd692fd3dffb491e87f56d69a6406e7da972ab59f0f83, us2.smtp.mailhostbox.com
 snakekeylogger, 1da8a820643459015205f97eb9b7abcdb173ce87bbdb74da0b79e970bbc32fc6, mail.stilltech.ro
 snakekeylogger, 7d1c91342282f5a34d6035a539fa1b3f0ae9e62182cb749c1269807b2deea2be, us2.smtp.mailhostbox.com
 snakekeylogger, 9a7a657e728c731ff69db20bfb86f32dea639d2020ed4415821161aced29f7b9, https://api.telegram.org/bot5427131313
 snakekeylogger, cfdb70e6469751ee66793a4c32efa8bcf3de901c0dfe422cba0679b65d13622f, us2.smtp.mailhostbox.com
 snakekeylogger, ea514283fd12de8e7d7a4938bb370d7987a78e1ef0bd25ccb9cf90f61b747b73, us2.smtp.mailhostbox.com
 snakekeylogger, f523562a67bc90b2cde0013d43272d25b18c179dabd6ac64c281147bce7d93d1, us2.smtp.mailhostbox.com
 unknownloader, b5fbe9746fe594d24e11713e418c40597b4ef256bfe1a460a1e093340443ec04, 185.106.94.14:6666
 vjw0rm, 9005a39c203e068daa077fe244e2608d36852dbef6f6ce8b28cc5cc015b89b1b, javaautorun.duia.ro
 xworm, 265f353a79c0781e17204623553f5ec3d358315f22b1d85bafc247e89774509e, secured1040online.duckdns.org

 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
	Date,Details,Email Payload Type,Users Targeted
	1/3/2023,ENQUIRY SO NO - 270; zip -> formbook,Attachment,15
	1/3/2023,Re: Fwd: PO EFT; img -> hta -> agenttesla,Attachment,2
	1/5/2023,Taxes; zip -> hta -> xworm,Attachment,3
	1/8/2023,RE:BL DRAFT SO# GOSUSNH1637860; zip -> formbook,Attachment,3
	1/8/2023,Payment Advice-BCS_ECS9522022121320540019_16334_952; doc -> agenttesla,Attachment,2
	1/9/2023,SHIPPING DOC (CI,COO,PL,BL); zip -> formbook,Attachment,3
	1/11/2023,Re: PO January Invoice_(Payment Confirmation); rar -> hta -> agenttesla,Attachment,2
	1/11/2023,RE: Purchase Order 8391-6; doc -> netwire,Attachment,3
	1/11/2023,Re: Fwd: PO_Invoice-Copy; rar -> hta -> agenttesla,Attachment,2
	1/11/2023,Re: Order 20230473 for week 3; zip -> remcos,Attachment,2
	1/11/2023,Re: Purchase Order (P.O.) No.4036041334; doc -> lokibot continued to 1/12,Attachment,3
	1/16/2023,NEW PO; img -> remcos,Attachment,3
	11/16/2023,Your Ultramar Invoice is Ready to View/Votre facture Ultramar est pr�t; one -> bat -> xworm,Attachment,22
	11/17/2023,FWD: Re: NEW ORDER (OUTSTANDING PO); doc -> agenttesla,Attachment,2
	11/18/2023,Shipment Document BL, INV and packing list; one -> asyncrat continued to 1/24,Attachment,3
	11/18/2023,Re: TOP URGENT Shipping Documents; doc -> agenttesla,Attachment,2
	1/21/2023,RE: Outstanding Account Statement For Very Well.; rar -> darkcloud,Attachment,3
	1/24/2023,Re: Purchase Order-23.01.2023; r05 -> agenttesla,Attachment,49
	1/25/2023,Re: find attached payment; xlsx -> remcos,Attachment,10
	1/28/2023,Bank Transfer from Us The chry sali sarchaeology; rar -> darkcloud,Attachment,2
	1/29/2023,FWD: check for payment urgently; xlsx -> remcos,Attachment,5
	1/29/2023,RE: Onquest China/Vietnam PO NBI_2300-123 / 35% Down Payment Terms; rar -> agenttesla,Attachment,2
	1/30/2023,Quotation Request; arj -> remcos,Attachment,3
	1/30/2023,RE: Payment; doc -> formbook,Attachment,2
	1/30/2023,Purchase Order with Price..; zip -> agenttesla,Attachment,4
	1/30/2023,RE: Processed payment; zip -> luminosity,Attachment,5
	1/31/2023,Request for quotation; xls -> formbook,Attachment,4

	agenttesla, 04263171f2d74a35541a07b05485709abd50d858deaf278f147a7557f9b2e76a, focuzpartsmart.com
	agenttesla, 0ebf4340d56b8018e2d6655311da863e7d3351ac9bda8438f2a42f51139d98a6, https://api.telegram.org/bot5249845718
	agenttesla, 14e7c7441ca7103c7cc9e96721342a7e60716c836f26a85037efdf6c7feae849, smtp.elec-qatar.com
	agenttesla, 1af68da9f45784f66b14b6760be4ab60486049e3aa41a8bbd35a95a1ef4faa1c, smtp.beckukk.com
	agenttesla, 1e61114dd0413c14225fd80ca645f3826d73c06319c71f24c29757c1cefaa163, mail.southernboilers.org
	agenttesla, 1e7690a67c8911298b510f2b12a46e26f906b657a89609b2ff4385c8a9f4878f, mail.biateknos.com
	agenttesla, 221a81d66ccd5492f313733aca66534af9350f427c50a6b30c7a65dce1ea0fbb, host39.registrar-servers.com
	agenttesla, 224695648fe70d6c4e2636192e87ab57d714d4a59188b331578f36758f23e318, smtp.beckukk.com
	agenttesla, 2299434f679982522b05bb2d725105b0d6adf6d8ab7b9c6c9b508eb50d26d99a, mail.sseximclearing.com
	agenttesla, 2827acabbd8a2d0213080c3cf3855db732799cabb5254bca6764734d16549b26, host39.registrar-servers.com
	agenttesla, 29ae2323ba55db42ad131386ef87f2748bc3fd98327b54a1bcc6378387494c8c, mail.elec-qatar.com
	agenttesla, 2f0ac14fdb816dc343425c23c4fd7f2ea5dfa93a547b57ff1402bc03adf7c800, focuzpartsmart.com
	agenttesla, 363b5b13158ff751910f1c9e250224792f690325f1d323546b70e5799c9da3cd, https://discord.com/api/webhooks/1060474967533301790
	agenttesla, 36856ffca1429da7e4a47d88ff8069505731d206666925eb996aca2abd09cad4, mail.elec-qatar.com
	agenttesla, 3bdbab28dae5e7dcaf32a879cfe9ef111eee48c76016a88f09bbebe547679041, https://api.telegram.org/bot2134979594
	agenttesla, 3d9bc90cfa2ddb3381b8e378d0e9f6f5f15e949fa4cfa469900720b17ba2578e, smtp.beckukk.com
	agenttesla, 3e22eae01de6d0f4b3a78b8fb15911270aa67f08233341c0fec84764b65a507d, smtp.elec-qatar.com
	agenttesla, 4795e398d5dce733ecb352580be08b33ae668684856a5cf34a8cc21fa303c60e, mail.strictfacilityservices.com
	agenttesla, 4e8d1a628ca70c4f5355d85722ba9f42d9a95dc14223d3892c89450e0a682669, mail.sseximclearing.com
	agenttesla, 4ec961389dcf825881ba0f1100d9ee32d5f7087e2337425d087fc0c5d768a990, mail.aquayflores.cl
	agenttesla, 50760724669f4ef9227085260826e8dd3b92aab51b2c5af925f283fbb741bceb, us2.smtp.mailhostbox.com
	agenttesla, 52ab9f2e3878dd9fa61c7bbbdfff113485fb4c12f8af0fa28b938696d68e54bb, https://api.telegram.org/bot5590596148
	agenttesla, 53d55a9c88eb76405269ee02a4c4818214be23b6793b348d817ebc764506e5af, mail.biateknos.com
	agenttesla, 564e748a2164cc70ec2c77d9830e301dedc3439f165fd8cc798bbd53fa168862, smtp.gmail.com
	agenttesla, 5984f06b2174c077939aef3eb600c56a03f35417e4c5add929d30345a6de428c, mail.abaexlogistics.com
	agenttesla, 5a7a08972825b0639cfb5645c0ee23a1acee08340223c7f5c7f015768ac77a18, mail.elec-qatar.com
	agenttesla, 5b8c0c56e48b1a5046c75da4416a009d3c9e00ab046223139551ba6c7126e4a7, mail.elec-qatar.com
	agenttesla, 5c879e5a07d1f6539515eb743a70d7b3ea22b3cd3ce1ff32cf6fb4a8447eaea2, mail.jackbarber.com
	agenttesla, 61f0682e81e51a2da57e9d2abd46efa24f920f3151757b5871db1932ff67de9b, mail.biateknos.com
	agenttesla, 6532e16d04ebfc98395b0e06fb2c1210d5064dc242c2c374beccb6b561a58f6f, cp5ua.hyperhost.ua
	agenttesla, 656b4aca18598d0fc4b53fa2585745d48498ced7d027e115643c7e50a5d92b9d, mail.qualitysolutions.co.in
	agenttesla, 67e8129c18c68670967b5957f52e9caa77fa896bfcaedd15996b9ca46cbdb686, mail.keefort.com.ec
	agenttesla, 6a0efe33cbf84ce5eef6931e1e05fcb20fbe87dbd4c621a0d1425f0412dad80c, nail.yantrika.com
	agenttesla, 6ba05012dc42370e27fe763cafdd4b4a09b0b198083199090dd1ff1856756d61, mail.qualitysolutions.co.in
	agenttesla, 72d186da41f7d6979ff9b012e4e5b5581da86946d60ffbc5870cc7b99dce192a, mail.sseximclearing.com
	agenttesla, 73f8f4b1fab2eeb0135f6207c88a0d5f7f8a5390ddd3f30403b7431ada2be289, us2.smtp.mailhostbox.com
	agenttesla, 7466aa2d482d74a4da0d1772009319a1507da78580178d9b2560586e53f99b74, mail.qualitysolutions.co.in
	agenttesla, 785d95955d4b6874b8af4dcfc1b75bcad1029ff37aeea13525cfd9295f1a5ee9, mail.southernboilers.org
	agenttesla, 7a5b7449fcd765f1a3be1dc0c8286cb46afe94b8c8040a0d268b27fe8d658ee4, smtp.gmail.com
	agenttesla, 7c388ef7f6f378929ecd8c0c32ecaca141cd21b5b9debd4b12ee5618fe0747d7, mail.sseximclearing.com
	agenttesla, 7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db, https://api.telegram.org/bot5590596148
	agenttesla, 87e32aa4c7cdad4872573c0d62e51e9256d1c774dbdebd2cb2e706734aa69e1f, mail.sseximclearing.com
	agenttesla, 8c61d194e68c94fcc2c577a5d61a697698c7aba068807c648e17ac4b93351dc2, mail.unrc.ir
	agenttesla, 8d95cc3446aa77c2e976b386b0acbd0dff59d19ef3a66619be28cd041376f582, focuzpartsmart.com
	agenttesla, 903cdb5e6c1c37c0934e99ab9e2db561273250fdd8a2cec152afb856a4f2b4cb, smtp.tvothaj.com
	agenttesla, 915cb8994b02a7d735b230b000ee1d7797500c5c0846b24103a9ad63956cbb41, smtp.elec-qatar.com
	agenttesla, 91f7c342ce163fe12c018a5068f921b5b78574cf05927bb85876be8484a2c237, https://discord.com/api/webhooks/1060474967533301790
	agenttesla, 944d12d7042e7f89a62aa636c97126aaf137425bf24e31974a282f6195cc584e, https://api.telegram.org/bot2134979594
	agenttesla, 971dfc5c82fae0d102f99d405119645d49629ab7679fe0d7eafeffeba4041d45, smtp.gmail.com
	agenttesla, 9b56ffabf61e4df4b774d198a6397b9ac6f431a59245b8400afa0b60bb017866, https://api.telegram.org/bot2134979594
	agenttesla, a53eafec588919d171746ba18abf11ca4643c9e2b858d3e825b5141946af0901, smtp.gmail.com
	agenttesla, a654440720fcdb36cc338da86c2c6beb922b3918c5341e168741a60a3d5ad2de, mail.strictfacilityservices.com
	agenttesla, aae65c255c24872651f5639421cfea382847382d50d40042cb931b7f7441d445, focuzpartsmart.com
	agenttesla, b0fdb78c68324224076f2d39061d3ad13c254e265a1842d87a6e7c8d49094e0e, smtp.elec-qatar.com
	agenttesla, b2eb6157f4c7092f16d815e898496e27da66b2a7b69639fee2eb707bd7237a62, api.telegram.org
	agenttesla, b6369635796fb8c318edbd1daa3d74816587157bf8b762c2d785ea7ccd10ad4c, host39.registrar-servers.com
	agenttesla, b6fcacde09c8e21c504ce0d553265a5fa7f5fabe0b7f8bb1ac8c62b6bf6de28e, smtp.beckukk.com
	agenttesla, cb4c05bf0a3cc9a2157b5b7799e3bdad472a0b677743ebb59803fa8934def97f, mail.jackbarber.com
	agenttesla, d07bee87efa9d63c230f1e4bb93dfcdec198e4ba69ca66e290d1e7bbc6f26078, focuzpartsmart.com
	agenttesla, d271d352cdd64384f1536695d0d0b281d23d79eae928c2491b87ec3f82422bf4, smtp.beckukk.com
	agenttesla, d4cf4250eb31e76e6468bc80f2768c42cf481696134beafc21739d987a36aa5e, https://api.telegram.org/bot2134979594
	agenttesla, d548bfcde55e09b8314b273b6fc1eff79563961b965cb83a763f4bb1b6c424ac, mail.goldismakina.com
	agenttesla, d8dcde33fb535be0d425f149fec9a6f686237c80dd6a1ed93c06fc973ef80a8d, smtp.beckukk.com
	agenttesla, dad8adf19a1adf3c1f83b948bf3866037d7a88e678fd6edf62a5c32ffe87565a, mail.strictfacilityservices.com
	agenttesla, e00c81eaf51d453c0a837df83d38b33cc4217bc40473a5a927c2434a1520a520, https://api.telegram.org/bot5249845718
	agenttesla, e134a17d9318e1460b4b352a30d64f417b01028e53ebdb151fd1edcfcbb1ab19, mail.clipjoint.co.nz
	agenttesla, e18b65850a6147b9ece9b7f2d8268303cdfa39c3c2ade801119f79191a6bc039, us2.smtp.mailhostbox.com
	agenttesla, e5b47dfdce0b43fbef23cf393838dffe7ea5173e73a783d881963e5b49b4f3d5, https://discord.com/api/webhooks/1061927100975681617
	agenttesla, e7ed6b0609943d4c6ddb3b032194d7fece3f9b5e2335f9ee0cbf4e1ba4b01efb, smtp.beckukk.com
	agenttesla, ea4684def9f3926d666c908edb9fa2646d33c2d84e7b502afbb987c5b2302cd7, mail.clipjoint.co.nz
	agenttesla, f2d560f960b4ab660621fef4d25d6b83b27da3deb53c1b0159c8abbc935a0ce4, mail.sseximclearing.com
	agenttesla, f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4, focuzpartsmart.com
	agenttesla, f8fa4a68488cfbb2c7130ee2637393f65e6a2585bf9171bcda0f0f7a7e4cffb6, https://api.telegram.org/bot5249845718
	agenttesla, f9eefe79d5efe2be33573c48777017ccdb97a3a1868628a8c2d8a207a03e67b6, focuzpartsmart.com
	agenttesla, fde6f4b70768e329b0d725843094cad8ee50638b32956c0edeefed2d551508d1, https://discord.com/api/webhooks/1061906591038844988
	agenttesla, fe867d208300886903bd50f715079f84291b6930c8b2aef827219b9689991f4f, mail.unrc.ir
	agenttesla, ffb64f4d42dd2de275cbf4ae7b334ffdd8920ff8fec95aca9900493472603d16, https://api.telegram.org/bot5590596148
	avemaria, c84447a3786502ee8e74208c08a2851720794669382eff06e874be595ecfe695, oneness.duckdns.org:8336
	darkcloud, 1716487b103dc267d5d1d0ad0f83565c11e3a18b0fd840f7b16893a14716b299, mail.krioncomputer.com
	darkcloud, 4848786ab1a4eb53f5bd0826c59c9620ea60e544b11e0d9183965fc0afe380de, [email protected]
	darkcloud, 93d81535630f75f9600b9a307dc2cd197f9f49361056cba8aa15cd5a4691831d, [email protected]
	darkcloud, b03225ede8b6ce37f12a6999260e06d0274ced375ac52294cae061a50dc61527, [email protected]
	formbook, 123e747239c973af2c8b7dc8a33b26fdc3cb05f2be8af864290f823daae7d764, http://www.2280400.online/ed9t/
	formbook, 139c10bab25d09231dfa465708c27632ed0618caaa710af0a1f326f80abd365b, adobeholidaylego.com/sk29
	formbook, 28ff484ca36b3a1f5d7f59a25e947e9a6b12ca34214f9bcfca01cee5745e6b6a, www.bilimmerkezleri.xyz/f649
	formbook, 2dac2db7d5d8e94a4eab1f98f30e282958a357eb496bfb2b9bd0fe532d8e0904, www.boltag.xyz/8qa3
	formbook, 492cabb55a2f649ce32194e8f9737a51f071b370bc9cd527aa8cd0b844ee7ea8, www.mon-coin-priere.store/umcs/
	formbook, 4ebe67fd893f6d8eb2a1bbb4ab73bea8c63a2741fc76b271cb1c9c05722a7dcb, http://www.chaatfunnnet.skin/ed9t/
	formbook, 5a125d1f8f0895426135345cf19d448fb3aaeacaa34eb055de6f2b89ac5dad17, http://www.capertidai.shop/f649/
	formbook, 5d40ae41d37143ffb8be9ec1d85563e3cd3b7def268abc33453b926d70a1aee7, www.bilimmerkezleri.xyz/f649
	formbook, 5ddfbe705b0cb87c996a1ebc61a337e8b5d187860c54c839cecf72a31ee375df, www.chaatfunnnet.skin/umcs
	formbook, 609e38239c20a1b1a2a1d773e18e467fb8097dcb2f398580c8780fc27d1df443, dupaxi.xyz/a09e
	formbook, 65c9f0517f21362d05bbc7361cf2fa89ae13933ac6f5d1c2092fff55795c20f3, www.primoilmio.bio/umcs
	formbook, 67388fca813133367167001c4114d6cd97b4bed24d0acdfda8b5784723a698ea, http://www.chaatfunnnet.skin/ed9t
	formbook, 67cc4306421a289d79bfd855c3da5e7ccbfe55e8eef44fc6c48aea748848ea5b, snowcrash.website/g2fg
	formbook, 6c7c0667c1f5d1832dac7b75704c408f0f48dbb7cd1e66550d92a873d9c50584, www.fatsecing.xyz/ippd
	formbook, 783dbf002227109a372c999fb01e0a6a542ff273dcb8a10e9080ba8d7466a6e8, www.dirdikyepedia.com/ed9t
	formbook, 7c530b0b55443db7e966b7420b27fb6ed79f8e70fc349fb00087f6d1e4b7cc25, www.dirdikyepedia.com/ed9t/
	formbook, 7ce7ca5deeb35f3cce19ca4e01e28aebe9f1b03dc8778a2e85e0d515a6df1a3e, fluidavail.online/oi05
	formbook, 7f284920214e53f8231f59b0ca2a804e41fb74ee8fd81b9ca86e6c39eadec7d2, www.paupocket.online/umcs/
	formbook, 81c0682751e0e809dc448f1bf8607a36c95840041de00cccd00032e066c6425e, www.dirdikyepedia.com/ed9t
	formbook, 82d7f1f5ad2b627a475ef42b781b92480b71f211491a363ad09c346fe0f3759e, http://www.chaatfunnnet.skin/ed9t/
	formbook, 87a8083bd4da6ab8f6b07927cd49581787ca70cdd9c2dee67de03682b3aa647d, www.bilimmerkezleri.xyz/f649
	formbook, a58a5f2c0f0ffae962702357f07665dbf49adc4c376aae50de4ce02745f3b06a, www.accordvent.xyz/f649
	formbook, bfc9cf8ef1369ba05191e708fea5b6c71d653dee922f15a53a7aed0642e1b756, http://www.chaatfunnnet.skin/ed9t/
	formbook, c18ffd59ba4e78061980e650dc6a2b6062f2829781ff7c061ba27f96cad60b5a, axie-connect.shop/gs12
	formbook, c33fd689aaab0c578d7569270d48b3c1fd9c9b28f45d81db6510326d0ddd0475, www.wanknumbers.co.uk/umcs
	formbook, d4a8cd1afe16b614f4edc31c747e1c62535fe24ee6fe0a7b8fbc6336d19562f8, www.ombqe.top/ed9t
	formbook, e2a0967cd49bb036d6f916e5cd1143d84e5c9de66c8674fd0a53caa2bc94ebe5, bellewayjewellery.com/gn92
	icedid, c06805b6efd482c1a671ec60c1469e47772c8937ec0496f74e987276fa9020a5, bloodfrakto.com
	lokibot, 4337ccc0329004c467b984ac20a8f86bf743a3e344900a6fadf4f73b2cfa0446, http://171.22.30.147/kelly/five/fre.php
	lokibot, 61a6189c8bf0e10eb20156d9c8847d3849d5307822ecea88bb3421835a347fb3, http://171.22.30.147/kelly/five/fre.php
	lokibot, 6f7d710effbef4c9dde9997af6ca7790d879e8e190b21bd5a43e099b27f6eb8a, http://171.22.30.147/kelly/five/fre.php
	luminosity, 36ce3b9ec0b50fcc219b1f1272363b8d3542b4afc3229e0251f58d9b27fb74e1, 185.17.0.79
	luminosity, 4cba59fde5a74d8e86638c65299b51adacc0ce2af56c1f17cb27c13bf5bb2263, 185.17.0.79
	luminosity, 9d58b6f6afb9a8237df181b9d0e1a250d122acd5d36208a3d2d7368bb9d25984, 185.17.0.79
	luminosity, aa4046ab8b9a2566c1a35d827ed97ce8f15e0254727d270807505f47d53aaeff, 185.17.0.79
	luminosity-agenttesla, 4a41861a81e4b094f22b2660ed6d0717892209452061d6c21668051651fe1763, mail.strictfacilityservices.com
	luminosity, bc6c1ee2b06d35ebb30a7ee02c682c6b72e5b3101cfb47e551301d2cfdc74ac7, 185.17.0.79
	luminosity, d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5, 185.17.0.79
	luminosity, e8ce64f1b350b774fe7f3704083b2f13bfe49ce8c50fec7580935f21b77e7257, 185.17.0.79
	luminosity, f01102bc0d4dd2e2508bcf195df1e52fe46afeba7b079cd7d9f51007ed9b6141, 185.17.0.79
	luminosity, fb8fdb08cf7984a3bac0cc7daeea3790a92306467543cf556945fc479a165dd8, 185.17.0.79
	modiloader-remcos, c266fa606a35b4ede65ae441e448dfcbf63b7a4e52091be0a6dc013b3e93c1f8, www.christopherferr.com:2404
	netwire, 0bcaaad38d8ff5881dae662a481b5f64bfeb71a40bf27d61a35889e7667ce44a, shevy.duckdns.org
	netwire, 467ef57122a909dadc6824af7c479e429cbd53428edece7472eec5993c2568d6, oneness.duckdns.org:3368
	origin, bfb963f003ea24be47ad11eddee613145bb6a470df3cee4579a50921d0a40797, https://discord.com/api/webhooks/1060474967533301790/
	purecrypter-remcos, 85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b, 194.180.49.17:28282
	purecryptor-agenttesla, 850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92, http://198.98.55.114/rights/inc/0b221f05c8d6c3.php
	purecryptor-remcos, f00982603a693995cf32649df28ac390ce839638751f04d11517454466061785, 194.180.49.17:28282
	remcos, 3ed1bebb7391002ffe104a9ffc9b0bf7fde5b42e3b5f798a6b02597775ebbf84, craigjonson1.gotdns.ch:2011
	remcos, 5a50e256c8ae0438325bcb04dc81fdac53d190ed1c818a00a770ae5f475cf522, 185.225.74.148:2404
	remcos, 6657f32b062ee72c7fbc5be2b486461a0e9b89d8115c87545248381e5bb96a8b, 194.180.49.17:28282
	remcos, a223dbd3e666c66e48d38bbc2e552a39bbfeb5f8b1663cdfa1d4a28543980c79, craigjonson1.gotdns.ch:2011
	remcos, a94e0b7244482530e7d071dad070b7801b5229d578b036dbf11ed1c854ed4690, 194.180.49.17:28282
	remcos, c0a5183fb178f4734580069f8697419dd8883a88bf69e57a2edb109d15d5cc9d, 195.133.40.168:54345
	snakekeylogger, 123a37dd6f535f44b95cd692fd3dffb491e87f56d69a6406e7da972ab59f0f83, us2.smtp.mailhostbox.com
	snakekeylogger, 1da8a820643459015205f97eb9b7abcdb173ce87bbdb74da0b79e970bbc32fc6, mail.stilltech.ro
	snakekeylogger, 7d1c91342282f5a34d6035a539fa1b3f0ae9e62182cb749c1269807b2deea2be, us2.smtp.mailhostbox.com
	snakekeylogger, 9a7a657e728c731ff69db20bfb86f32dea639d2020ed4415821161aced29f7b9, https://api.telegram.org/bot5427131313
	snakekeylogger, cfdb70e6469751ee66793a4c32efa8bcf3de901c0dfe422cba0679b65d13622f, us2.smtp.mailhostbox.com
	snakekeylogger, ea514283fd12de8e7d7a4938bb370d7987a78e1ef0bd25ccb9cf90f61b747b73, us2.smtp.mailhostbox.com
	snakekeylogger, f523562a67bc90b2cde0013d43272d25b18c179dabd6ac64c281147bce7d93d1, us2.smtp.mailhostbox.com
	unknownloader, b5fbe9746fe594d24e11713e418c40597b4ef256bfe1a460a1e093340443ec04, 185.106.94.14:6666
	vjw0rm, 9005a39c203e068daa077fe244e2608d36852dbef6f6ce8b28cc5cc015b89b1b, javaautorun.duia.ro
	xworm, 265f353a79c0781e17204623553f5ec3d358315f22b1d85bafc247e89774509e, secured1040online.duckdns.org

	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]
	[email protected]