Edit tour

Windows Analysis Report
payment_invoice.exe

Overview

General Information

Sample name:	payment_invoice.exe
Analysis ID:	1429066
MD5:	af9695cf3142c1fe17e398bf452c290c
SHA1:	295d6df899de93ff4835b067c31c502ce894d92e
SHA256:	566a2a768b83757d7c2398bf9f1f84deef8bb4b238da9431fff343b262227c6b
Tags:	exePayment
Infos:

Detection

PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Set autostart key via New-ItemProperty Cmdlet

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains potential unpacker

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates multiple autostart registry keys

Drops large PE files

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: Notepad Making Network Connection

Sigma detected: Suspicious Process Parents

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

payment_invoice.exe (PID: 6532 cmdline: "C:\Users\user\Desktop\payment_invoice.exe" MD5: AF9695CF3142C1FE17E398BF452C290C)

payment_invoice.exe (PID: 2516 cmdline: "C:\Users\user\Desktop\payment_invoice.exe" MD5: AF9695CF3142C1FE17E398BF452C290C)

powershell.exe (PID: 1832 cmdline: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

notepad.exe (PID: 2720 cmdline: "C:\Users\user\AppData\Local\notepad.exe" MD5: 27970A76FAAD8CB3DB5DF74672ACC3CB)

notepad.exe (PID: 3796 cmdline: "C:\Users\user\AppData\Local\notepad.exe" MD5: 27970A76FAAD8CB3DB5DF74672ACC3CB)

powershell.exe (PID: 1780 cmdline: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

notepad.exe (PID: 6960 cmdline: "C:\Users\user\AppData\Local\notepad.exe" MD5: 27970A76FAAD8CB3DB5DF74672ACC3CB)

notepad.exe (PID: 2024 cmdline: "C:\Users\user\AppData\Local\notepad.exe" MD5: 27970A76FAAD8CB3DB5DF74672ACC3CB)

payment_invoice.exe (PID: 6692 cmdline: "C:\Users\user\Desktop\payment_invoice.exe" MD5: AF9695CF3142C1FE17E398BF452C290C)

payment_invoice.exe (PID: 1664 cmdline: "C:\Users\user\Desktop\payment_invoice.exe" MD5: AF9695CF3142C1FE17E398BF452C290C)

payment_invoice.exe (PID: 1208 cmdline: "C:\Users\user\Desktop\payment_invoice.exe" MD5: AF9695CF3142C1FE17E398BF452C290C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5d6ba:$s1: file:/// 0x5d5c8:$s2: {11111-22222-10009-11112} 0x5d64a:$s3: {11111-22222-50001-00000} 0x596b2:$s4: get_Module 0x5998f:$s5: Reverse 0x529fb:$s6: BlockCopy 0x53a96:$s7: ReadByte 0x5d6cc:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2581231238.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2518262615.0000000004651000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2116746974.00000000071A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2581231238.00000000030E4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2102278081.0000000004733000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000002.3100460918.0000000004991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2111959813.0000000005220000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2607816073.0000000004638000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2099128465.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2099128465.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2484397590.0000000002E83000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2601872712.00000000054F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2822552993.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2489840693.0000000004324000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2484397590.00000000030C6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2604821885.0000000005740000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2099128465.0000000002BB2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2607816073.00000000042C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: payment_invoice.exe PID: 6532	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: payment_invoice.exe PID: 6532	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: payment_invoice.exe PID: 2516	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: payment_invoice.exe PID: 2516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: notepad.exe PID: 2720	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: notepad.exe PID: 2720	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: notepad.exe PID: 6960	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: notepad.exe PID: 6960	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: payment_invoice.exe PID: 6692	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: payment_invoice.exe PID: 6692	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: notepad.exe PID: 3796	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: notepad.exe PID: 3796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 36 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.payment_invoice.exe.5740000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.payment_invoice.exe.5d00000.8.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
4.2.payment_invoice.exe.5d00000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.payment_invoice.exe.5d00000.8.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5b8ba:$s1: file:/// 0x5b7c8:$s2: {11111-22222-10009-11112} 0x5b84a:$s3: {11111-22222-50001-00000} 0x578b2:$s4: get_Module 0x57b8f:$s5: Reverse 0x50bfb:$s6: BlockCopy 0x51c96:$s7: ReadByte 0x5b8cc:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
4.2.payment_invoice.exe.5d00000.8.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
4.2.payment_invoice.exe.5d00000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.payment_invoice.exe.5d00000.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5d6ba:$s1: file:/// 0x5d5c8:$s2: {11111-22222-10009-11112} 0x5d64a:$s3: {11111-22222-50001-00000} 0x596b2:$s4: get_Module 0x5998f:$s5: Reverse 0x529fb:$s6: BlockCopy 0x53a96:$s7: ReadByte 0x5d6cc:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
6.2.notepad.exe.4638eb0.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.payment_invoice.exe.54f0000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.payment_invoice.exe.71a0000.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.payment_invoice.exe.5250000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.payment_invoice.exe.5250000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.payment_invoice.exe.2b6cb58.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.notepad.exe.324cb08.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.notepad.exe.4371878.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.payment_invoice.exe.5220000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.payment_invoice.exe.5220000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.payment_invoice.exe.4733458.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.payment_invoice.exe.4733458.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.notepad.exe.43f4660.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Notepad Making Network Connection

Source: Network Connection

Author: EagleEye Team: Data: DestinationIp: 91.92.255.61, DestinationIsIpv6: false, DestinationPort: 9817, EventID: 3, Image: C:\Users\user\AppData\Local\notepad.exe, Initiated: true, ProcessId: 3796, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String', CommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String', CommandLine|base64offset|contains: E^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\notepad.exe", ParentImage: C:\Users\user\AppData\Local\notepad.exe, ParentProcessId: 3796, ParentProcessName: notepad.exe, ProcessCommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String', ProcessId: 1780, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\notepad.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\payment_invoice.exe, ProcessId: 6532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String', CommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String', CommandLine|base64offset|contains: E^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\payment_invoice.exe", ParentImage: C:\Users\user\Desktop\payment_invoice.exe, ParentProcessId: 2516, ParentProcessName: payment_invoice.exe, ProcessCommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String', ProcessId: 1832, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Set autostart key via New-ItemProperty Cmdlet

Source: Process started

Author: Joe Security: Data: Command: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String', CommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String', CommandLine|base64offset|contains: E^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\payment_invoice.exe", ParentImage: C:\Users\user\Desktop\payment_invoice.exe, ParentProcessId: 2516, ParentProcessName: payment_invoice.exe, ProcessCommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String', ProcessId: 1832, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Multi AV Scanner detection for submitted file

Source: payment_invoice.exe	Virustotal: Detection: 38%			Perma Link
Source: payment_invoice.exe	ReversingLabs: Detection: 36%

Machine Learning detection for sample

Source: payment_invoice.exe

Joe Sandbox ML: detected

Source: payment_invoice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: payment_invoice.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura.dotnetzip.pdb.compressed source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Yxpsjupoox.pdb source: payment_invoice.exe, 00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: $^q costura.dotnetzip.pdb.compressedlB^q source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: payment_invoice.exe, 00000000.00000002.2114603281.0000000005510000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2489840693.0000000003FF4000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: payment_invoice.exe, 00000000.00000002.2114603281.0000000005510000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2489840693.0000000003FF4000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q costura.dotnetzip.pdb.compressed source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: payment_invoice.exe, 00000004.00000002.2618644569.0000000007280000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\	Jump to behavior

Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then jmp 029F8CEDh	0_2_029F8AC0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_029FEF58
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then jmp 029F8CEDh	0_2_029F8AB0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then jmp 029F83ABh	0_2_029F7FB0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then jmp 029F83ABh	0_2_029F7FC0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_029FEF50
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then jmp 02A15C10h	0_2_02A15A18
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4x nop then jmp 02A15C10h	0_2_02A15A0B
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_04E4EF58
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 04E48CEDh	5_2_04E48AC0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 04E483ABh	5_2_04E47FC0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 04E483ABh	5_2_04E47FB0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_04E4EF50
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_04E4EF32
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 04E48CEDh	5_2_04E48AB0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 04E65C10h	5_2_04E65A18
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 04E65C10h	5_2_04E65A08
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_0576EF58
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 05768CEDh	6_2_05768AC0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_0576EF50
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 057683ABh	6_2_05767FC0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 057683ABh	6_2_05767FB0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 4x nop then jmp 05768CEDh	6_2_05768AB0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\notepad.exe

Network Connect: 91.92.255.61 9817

Uses dynamic DNS services

Source: unknown

DNS query: name: purfufu3flujs.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 91.92.255.61:9817

Source: Joe Sandbox View

ASN Name: THEZONEBG THEZONEBG

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: purfufu3flujs.duckdns.org

Source: powershell.exe, 00000007.00000002.2363706750.0000000005E61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000E.00000002.2741226026.00000000043C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2940946170.0000000006CD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.0000000003143000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000030E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2321795797.0000000004E01000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2741226026.0000000004271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.2741226026.00000000043C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2940946170.0000000006CD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: payment_invoice.exe, 00000004.00000002.2618644569.0000000007280000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: powershell.exe, 00000007.00000002.2321795797.0000000004E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2741226026.0000000004271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.2741226026.00000000043C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2940946170.0000000006CD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.000000000319C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002ABC000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.3100460918.00000000048B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000007.00000002.2363706750.0000000005E61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install

Source: C:\Users\user\Desktop\payment_invoice.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Local\notepad.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.payment_invoice.exe.5d00000.8.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 4.2.payment_invoice.exe.5d00000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen

Drops large PE files

Source: C:\Users\user\Desktop\payment_invoice.exe

File dump: notepad.exe.0.dr 271204531

Jump to dropped file

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: payment_invoice.exe

Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_00EFDDE8	0_2_00EFDDE8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_00EFC7F8	0_2_00EFC7F8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_029FA006	0_2_029FA006
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_029F99BC	0_2_029F99BC
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_029F5258	0_2_029F5258
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1D7C0	0_2_02A1D7C0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1F470	0_2_02A1F470
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A13808	0_2_02A13808
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A129D8	0_2_02A129D8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1CE88	0_2_02A1CE88
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1E267	0_2_02A1E267
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1D7B0	0_2_02A1D7B0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A12488	0_2_02A12488
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1F460	0_2_02A1F460
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1CE7A	0_2_02A1CE7A
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_050626E8	0_2_050626E8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_05064728	0_2_05064728
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_05064738	0_2_05064738
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_0619D4B8	0_2_0619D4B8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_06180040	0_2_06180040
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_0619C890	0_2_0619C890
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F09670	4_2_00F09670
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F01050	4_2_00F01050
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F01041	4_2_00F01041
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F016D8	4_2_00F016D8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F016D8	4_2_00F016D8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F0176A	4_2_00F0176A
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F0174F	4_2_00F0174F
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F01725	4_2_00F01725
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F0170A	4_2_00F0170A
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_051B3BD9	4_2_051B3BD9
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_051B3BF8	4_2_051B3BF8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_053E47D0	4_2_053E47D0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_053E5890	4_2_053E5890
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_053E4B1F	4_2_053E4B1F
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_055EB138	4_2_055EB138
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_055E5A78	4_2_055E5A78
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_055EBB10	4_2_055EBB10
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_055EBB20	4_2_055EBB20
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_055EBAF2	4_2_055EBAF2
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_055EBAAF	4_2_055EBAAF
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_057F61B0	4_2_057F61B0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_057FB6A8	4_2_057FB6A8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_057FAA20	4_2_057FAA20
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05D90869	4_2_05D90869
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05D9DF10	4_2_05D9DF10
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DEB040	4_2_05DEB040
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DE6CA0	4_2_05DE6CA0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DEBC58	4_2_05DEBC58
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DE34D8	4_2_05DE34D8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DE34C8	4_2_05DE34C8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DE56C0	4_2_05DE56C0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DE5690	4_2_05DE5690
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05DEB388	4_2_05DEB388
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071DE9B8	4_2_071DE9B8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071D3E80	4_2_071D3E80
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071D29F9	4_2_071D29F9
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_0155DDE8	5_2_0155DDE8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_0155C7F8	5_2_0155C7F8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E4A006	5_2_04E4A006
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E45170	5_2_04E45170
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E499BC	5_2_04E499BC
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E42DB0	5_2_04E42DB0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E6E090	5_2_04E6E090
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E63808	5_2_04E63808
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E629D8	5_2_04E629D8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E62488	5_2_04E62488
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E6E081	5_2_04E6E081
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_05911560	5_2_05911560
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_059135B0	5_2_059135B0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_059135C0	5_2_059135C0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_0658D4B8	5_2_0658D4B8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_06570040	5_2_06570040
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_06570006	5_2_06570006
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_0658C890	5_2_0658C890
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_015FDDE8	6_2_015FDDE8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_015FC7F8	6_2_015FC7F8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_05765170	6_2_05765170
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_05769FFB	6_2_05769FFB
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_057699BC	6_2_057699BC
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_05CA1560	6_2_05CA1560
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_05CA35C0	6_2_05CA35C0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_05CA35B7	6_2_05CA35B7
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_00C5DDE8	9_2_00C5DDE8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_00C5C7F8	9_2_00C5C7F8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_027B2480	9_2_027B2480
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_027B44D0	9_2_027B44D0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_027B44C0	9_2_027B44C0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_027B3F2F	9_2_027B3F2F
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_0605D4B8	9_2_0605D4B8
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_06040006	9_2_06040006
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_06040040	9_2_06040040
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_0605C890	9_2_0605C890
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_01369670	10_2_01369670
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_01361050	10_2_01361050
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_01361041	10_2_01361041
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_01361725	10_2_01361725
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0136170A	10_2_0136170A
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0136176A	10_2_0136176A
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0136174F	10_2_0136174F
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_013616D8	10_2_013616D8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_013616D8	10_2_013616D8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_054F3BD7	10_2_054F3BD7
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_054F3BF8	10_2_054F3BF8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_057547F2	10_2_057547F2
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_05755890	10_2_05755890
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_05754B1F	10_2_05754B1F
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0595B138	10_2_0595B138
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0595C250	10_2_0595C250
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_05955838	10_2_05955838
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0595BB0F	10_2_0595BB0F
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0595BB20	10_2_0595BB20
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_05B661B0	10_2_05B661B0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_05B6B6A8	10_2_05B6B6A8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_05B6AA20	10_2_05B6AA20
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_06600869	10_2_06600869
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0660DF10	10_2_0660DF10
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066C4680	10_2_066C4680
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066C4690	10_2_066C4690
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066DBC58	10_2_066DBC58
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066D6CA0	10_2_066D6CA0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066DB040	10_2_066DB040
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066D56C0	10_2_066D56C0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066D56B1	10_2_066D56B1
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066D34C8	10_2_066D34C8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066D34D8	10_2_066D34D8
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_066DB388	10_2_066DB388

Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004733000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHvakvloi.dll" vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2111959813.0000000005220000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameHvakvloi.dll" vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2114603281.0000000005510000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLifrbjzigcn.exe" vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002C00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLifrbjzigcn.exe" vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe, 00000000.00000002.2095793839.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameYxpsjupoox.dll" vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2618644569.0000000007280000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZip.dll@ vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameClassLibrary1.dll" vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2502969950.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs payment_invoice.exe
Source: payment_invoice.exe, 00000004.00000002.2496931759.00000000004D4000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLifrbjzigcn.exe" vs payment_invoice.exe
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs payment_invoice.exe
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002ABC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLifrbjzigcn.exe" vs payment_invoice.exe
Source: payment_invoice.exe, 00000009.00000002.2822552993.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs payment_invoice.exe
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs payment_invoice.exe
Source: payment_invoice.exe	Binary or memory string: OriginalFilenameclean.exe, vs payment_invoice.exe

Source: payment_invoice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.payment_invoice.exe.5d00000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 4.2.payment_invoice.exe.5d00000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/56@6/1

Source: C:\Users\user\Desktop\payment_invoice.exe

File created: C:\Users\user\AppData\Local\notepad.exe

Jump to behavior

Source: C:\Users\user\Desktop\payment_invoice.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\payment_invoice.exe	Mutant created: \Sessions\1\BaseNamedObjects\3773f709858a89ca
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2228:120:WilError_03

Source: C:\Users\user\Desktop\payment_invoice.exe

File created: C:\Users\user\AppData\Local\Temp\Cyjei.tmpdb

Jump to behavior

Source: payment_invoice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: payment_invoice.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\payment_invoice.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\payment_invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: payment_invoice.exe	Virustotal: Detection: 38%
Source: payment_invoice.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\payment_invoice.exe

File read: C:\Users\user\Desktop\payment_invoice.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"
Source: unknown	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String'	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String'

Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\notepad.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\payment_invoice.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\payment_invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\payment_invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\payment_invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: payment_invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: payment_invoice.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: payment_invoice.exe

Static file information: File size 3099136 > 1048576

Source: payment_invoice.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2f4000

Source: payment_invoice.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura.dotnetzip.pdb.compressed source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Yxpsjupoox.pdb source: payment_invoice.exe, 00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: $^q costura.dotnetzip.pdb.compressedlB^q source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: payment_invoice.exe, 00000000.00000002.2114603281.0000000005510000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2489840693.0000000003FF4000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: payment_invoice.exe, 00000000.00000002.2114603281.0000000005510000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2489840693.0000000003FF4000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q costura.dotnetzip.pdb.compressed source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: payment_invoice.exe, 00000004.00000002.2618644569.0000000007280000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.payment_invoice.exe.4a1d258.3.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.payment_invoice.exe.4a1d258.3.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.payment_invoice.exe.4a1d258.3.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.payment_invoice.exe.4a1d258.3.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.payment_invoice.exe.4a1d258.3.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Suspicious powershell command line found

Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String'
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String'
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String'	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String'

Yara detected Costura Assembly Loader

Source: Yara match	File source: 4.2.payment_invoice.exe.5740000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.notepad.exe.4638eb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.54f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.71a0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.payment_invoice.exe.2b6cb58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.notepad.exe.324cb08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.notepad.exe.4371878.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2581231238.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2116746974.00000000071A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2581231238.00000000030E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2607816073.0000000004638000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2099128465.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2099128465.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2484397590.0000000002E83000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2601872712.00000000054F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2822552993.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2484397590.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2604821885.0000000005740000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2099128465.0000000002BB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2607816073.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: payment_invoice.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: payment_invoice.exe PID: 2516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 2720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: payment_invoice.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 3796, type: MEMORYSTR

Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_029F8840 push esp; iretd	0_2_029F8849
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_02A1FA82 pushfd ; retf	0_2_02A1FB01
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_06181937 push ebp; retf	0_2_06181938
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 0_2_06183DDF push ds; ret	0_2_06183DE0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_00F053EC push ss; ret	4_2_00F053F4
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_055EEE12 push cs; iretd	4_2_055EEE13
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_057E2C4B push BEFFFFECh; retf 0000h	4_2_057E2C51
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_05D93F7D push E9FFFFFFh; iretd	4_2_05D93F82
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071DC748 push FFFFFF8Bh; iretd	4_2_071DC74A
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071DC778 push FFFFFF8Bh; iretd	4_2_071DC77A
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071DCF6F push es; ret	4_2_071DCF70
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071DADFF push es; retf	4_2_071DAE00
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 4_2_071DC87A push FFFFFF8Bh; iretd	4_2_071DC87C
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E4C55A push esp; iretd	5_2_04E4C565
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E48840 push esp; iretd	5_2_04E48849
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_04E42BC5 push 8B506CB8h; retf	5_2_04E42BCA
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_06571937 push ebp; retf	5_2_06571938
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 5_2_06573DDF push ds; ret	5_2_06573DE0
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 6_2_05768840 push esp; iretd	6_2_05768849
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_06043DDF push ds; ret	9_2_06043DE0
Source: C:\Users\user\Desktop\payment_invoice.exe	Code function: 9_2_06041937 push ebp; retf	9_2_06041938
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_013653EC push ss; ret	10_2_013653F4
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_0595EE12 push cs; iretd	10_2_0595EE13
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_05B52C4B push BEFFFFECh; retf 0000h	10_2_05B52C51
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_06603F7D push E9FFFFFFh; iretd	10_2_06603F82
Source: C:\Users\user\AppData\Local\notepad.exe	Code function: 10_2_06605B5A push FFFFFFD5h; retf	10_2_06605B5C

Source: C:\Users\user\Desktop\payment_invoice.exe

File created: C:\Users\user\AppData\Local\notepad.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run notepad
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run payment_invoice

Source: C:\Users\user\Desktop\payment_invoice.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run notepad	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run notepad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run payment_invoice
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run payment_invoice
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run notepad
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run notepad

Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment_invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\notepad.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: payment_invoice.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 2720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: payment_invoice.exe PID: 6692, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE
Source: notepad.exe, 00000005.00000002.2484397590.00000000030DE000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000030E4000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL@\^Q
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002BB2000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000030E4000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EXPLORER9SBIEDLL.DLL:SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE;VERSION<SERIALNUMBER>VMWARE\|VIRTUAL\|A M I\|XEN?SELECT * FROM WIN32_COMPUTERSYSTEM@MANUFACTURERAMODELBMICROSOFT\|VMWARE\|VIRTUALCJOHNDANNAEXXXXXXXX

Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 61A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 59B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 7740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 61A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 1510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 4E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 6590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 5DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 15F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: C50000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 28F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 27B0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 6540000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 17540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 1360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 4EE0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: E00000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 2790000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 24E0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 5EC0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 5650000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 72F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 5EC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 1220000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\notepad.exe	Memory allocated: 4DA0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 1140000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 2C20000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\payment_invoice.exe	Memory allocated: 12C0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\payment_invoice.exe	Window / User API: threadDelayed 5820	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Window / User API: threadDelayed 1371	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3641
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2172
Source: C:\Users\user\AppData\Local\notepad.exe	Window / User API: threadDelayed 3870
Source: C:\Users\user\AppData\Local\notepad.exe	Window / User API: threadDelayed 438
Source: C:\Users\user\AppData\Local\notepad.exe	Window / User API: threadDelayed 842
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1694
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 881

Source: C:\Users\user\Desktop\payment_invoice.exe TID: 6580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe TID: 7104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe TID: 3868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe TID: 2180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe TID: 1060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 3641 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 2172 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2032	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\payment_invoice.exe TID: 5764	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\notepad.exe TID: 4088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\notepad.exe TID: 3636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\notepad.exe TID: 6732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\notepad.exe TID: 1988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1404	Thread sleep count: 1694 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1404	Thread sleep count: 881 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5212	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7092	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\notepad.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\payment_invoice.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\notepad.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\	Jump to behavior

Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware\V
Source: notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen@\^q
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR^q
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen(_^q
Source: notepad.exe, 0000000A.00000002.2799467373.0000000001175000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgura#Yz
Source: notepad.exe, 00000005.00000002.2484397590.0000000002E95000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.000000000306A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ^qemU
Source: notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR^q<
Source: payment_invoice.exe, 00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: zfQ0BSQemuAF7YLOnyP
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: explorer9SbieDll.dll:select * from Win32_BIOS8Unexpected WMI query failure;version<SerialNumber>VMware\|VIRTUAL\|A M I\|Xen?select * from Win32_ComputerSystem@manufacturerAmodelBMicrosoft\|VMWare\|VirtualCjohnDannaExxxxxxxx
Source: notepad.exe, 00000005.00000002.2484397590.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: crosoft\|VMWare\|Virtual
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareLR^q
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DZPXL 4PYU2K7DNF@\^q0VMware\|VIRTUAL\|A M<
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR^q(x
Source: notepad.exe, 00000005.00000002.2484397590.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hdpcWVLM5omRk5c odDYz AV@\^q0Microsoft\|VMWare\|V<
Source: payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hdpcWVLM5omRk5c odDYz AV@\^q0Microsoft\|VMWare\|V<r*
Source: notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:Microsoft\|VMWare\|Virtual
Source: notepad.exe, 00000005.00000002.2484397590.0000000002E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ^qEmU
Source: payment_invoice.exe, 00000004.00000002.2596286332.00000000053F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\payment_invoice.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\payment_invoice.exe

Code function: 0_2_029FEF58 CheckRemoteDebuggerPresent,

0_2_029FEF58

Source: C:\Users\user\Desktop\payment_invoice.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\payment_invoice.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\payment_invoice.exe

Code function: 4_2_071DCBF8 LdrInitializeThunk,

4_2_071DCBF8

Source: C:\Users\user\Desktop\payment_invoice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\payment_invoice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\notepad.exe

Network Connect: 91.92.255.61 9817

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\payment_invoice.exe	Memory written: C:\Users\user\Desktop\payment_invoice.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory written: C:\Users\user\AppData\Local\notepad.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Memory written: C:\Users\user\AppData\Local\notepad.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String'	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Users\user\AppData\Local\notepad.exe "C:\Users\user\AppData\Local\notepad.exe"	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Users\user\Desktop\payment_invoice.exe "C:\Users\user\Desktop\payment_invoice.exe"
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String'

Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'payment_invoice';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'payment_invoice' -value '"c:\users\user\desktop\payment_invoice.exe"' -propertytype 'string'
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'notepad';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'notepad' -value '"c:\users\user\appdata\local\notepad.exe"' -propertytype 'string'
Source: C:\Users\user\Desktop\payment_invoice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'payment_invoice';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'payment_invoice' -value '"c:\users\user\desktop\payment_invoice.exe"' -propertytype 'string'	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'notepad';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'notepad' -value '"c:\users\user\appdata\local\notepad.exe"' -propertytype 'string'

Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Users\user\Desktop\payment_invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Users\user\Desktop\payment_invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\notepad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\notepad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Users\user\Desktop\payment_invoice.exe VolumeInformation
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\notepad.exe VolumeInformation
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Users\user\Desktop\payment_invoice.exe VolumeInformation
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\notepad.exe VolumeInformation
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\notepad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\payment_invoice.exe	Queries volume information: C:\Users\user\Desktop\payment_invoice.exe VolumeInformation

Source: C:\Users\user\Desktop\payment_invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\payment_invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\notepad.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5250000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5250000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.5220000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.4733458.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.4733458.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.notepad.exe.43f4660.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2518262615.0000000004651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102278081.0000000004733000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3100460918.0000000004991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111959813.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2489840693.0000000004324000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3
Source: payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: payment_invoice.exe, 00000000.00000002.2102278081.0000000004733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\VERSION.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f\vocab_en.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\VERSION.txt	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\VERSION.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\VERSION.txt
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f\vocab_en.txt	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f\vocab_en.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f\vocab_en.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\payment_invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\notepad.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: payment_invoice.exe PID: 2516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 3796, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5250000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5250000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.5220000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.4733458.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.payment_invoice.exe.4733458.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.notepad.exe.43f4660.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2518262615.0000000004651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102278081.0000000004733000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3100460918.0000000004991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111959813.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2489840693.0000000004324000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.payment_invoice.exe.5d00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	41 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	211 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	61 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	61 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
payment_invoice.exe	38%	Virustotal		Browse
payment_invoice.exe	37%	ReversingLabs	Win32.Packed.Generic
payment_invoice.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
10.76.9.0.in-addr.arpa	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
purfufu3flujs.duckdns.org	91.92.255.61	true	true		unknown
10.76.9.0.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.2363706750.0000000005E61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.000000000319C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002ABC000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.3100460918.00000000048B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000E.00000002.2741226026.00000000043C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2940946170.0000000006CD4000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000007.00000002.2321795797.0000000004E01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2741226026.0000000004271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000E.00000002.2741226026.00000000043C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2940946170.0000000006CD4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	false		high
https://contoso.com/	powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.2363706750.0000000005E61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.2868312127.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-net	payment_invoice.exe, 00000000.00000002.2102278081.0000000004A1D000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2097332579.0000000002980000.00000004.08000000.00040000.00000000.sdmp, payment_invoice.exe, 00000000.00000002.2099128465.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.000000000451C000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000004.00000002.2518262615.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.codeplex.com/DotNetZip	payment_invoice.exe, 00000004.00000002.2618644569.0000000007280000.00000004.08000000.00040000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	payment_invoice.exe, 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Edgqvqch.tmpdb.10.dr, Sjksbgl.tmpdb.10.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	payment_invoice.exe, 00000000.00000002.2099128465.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.2484397590.0000000003143000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.0000000003397000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000006.00000002.2581231238.00000000030E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2321795797.0000000004E01000.00000004.00000800.00020000.00000000.sdmp, payment_invoice.exe, 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2741226026.0000000004271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000E.00000002.2741226026.00000000043C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2940946170.0000000006CD4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.92.255.61	purfufu3flujs.duckdns.org	Bulgaria		34368	THEZONEBG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429066
Start date and time:	2024-04-20 15:20:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	payment_invoice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/56@6/1
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 89% Number of executed functions: 609 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target payment_invoice.exe, PID 6692 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1832 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:21:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run notepad C:\Users\user\AppData\Local\notepad.exe
14:21:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run notepad C:\Users\user\AppData\Local\notepad.exe
14:22:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run payment_invoice C:\Users\user\Desktop\payment_invoice.exe
14:22:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run payment_invoice C:\Users\user\Desktop\payment_invoice.exe
15:22:02	API Interceptor	6x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	SecuriteInfo.com.Trojan.DownLoaderNET.960.20799.14959.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	91.92.254.152
	SecuriteInfo.com.Trojan.DownLoader46.57007.12424.22631.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	91.92.254.152
	SecuriteInfo.com.Trojan.DownLoaderNET.960.127.1983.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	91.92.254.152
	SecuriteInfo.com.Trojan.DownLoader46.57266.15231.8507.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	91.92.246.15
	SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe	Get hash	malicious	PureLog Stealer	Browse	91.92.246.79
	lqoUUYTMsL.exe	Get hash	malicious	Lokibot	Browse	91.92.253.228
	HW#210872-218YAT-THEON-GLOBAL-Y801823-1AHEY361-APL38102823-19011.exe	Get hash	malicious	GuLoader, PureLog Stealer, zgRAT	Browse	91.92.248.36
	cybXkFC5nF.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	91.92.255.15
	6Qz6WEKB27.elf	Get hash	malicious	Mirai	Browse	91.92.243.252
	RyykKfCeTG.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.92.240.254

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	5.354120267532675
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qpAE4KzecKDE4KhKiKhBsXE4qdKm:MIHK5HKH1qHmAHKzecYHKh3okHA
MD5:	16EE64AF7526B49B619695B12E3B111C
SHA1:	9705C47B8323B331FF19798231EE113F50F3B505
SHA-256:	0DB80F91436962FBD00CD09651C67468C81A0805170239298BA85066AE348D29
SHA-512:	F852E00C4B1D297376DB0FB7114C75957765DDE1D92B2822113B9C965E5974C52BBF516E1384823BC5D8DE4EDC7EEF8704EAEAD8FF565EA416E6CDB99285E118
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payment_invoice.exe.log

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	5.354120267532675
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qpAE4KzecKDE4KhKiKhBsXE4qdKm:MIHK5HKH1qHmAHKzecYHKh3okHA
MD5:	16EE64AF7526B49B619695B12E3B111C
SHA1:	9705C47B8323B331FF19798231EE113F50F3B505
SHA-256:	0DB80F91436962FBD00CD09651C67468C81A0805170239298BA85066AE348D29
SHA-512:	F852E00C4B1D297376DB0FB7114C75957765DDE1D92B2822113B9C965E5974C52BBF516E1384823BC5D8DE4EDC7EEF8704EAEAD8FF565EA416E6CDB99285E118
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	5.3742006658295995
Encrypted:	false
SSDEEP:	24:3gWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9tXt/NK3R8IHrcLM:QWSU4y4RQmFoUeWmfmZ9tlNWR8IH4I
MD5:	9E9DAF44A79DFC404A1F18607F1932D6
SHA1:	6A379321991BEFD0BE1097301303298602D1E2F7
SHA-256:	052137559A940B0BFAA892EB2497ADF8C8A99B7E184145EF5453B34799CD8F12
SHA-512:	F0C2206C88942530F1C8CB9C459739261DFF20C70F9303B40FF9AC5A8E14EB3386364C8D7660B95C01E0C889BDC93681DFE9BB2830E8335719DF2A25D9B8F8F8
Malicious:	false
Reputation:	low
Preview:	@...e.................................:.........................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\Ahaqlwdjt.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ajeqbh.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bfbbbybxdyd.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bicfm.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bwsqsvl.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cjvwjs.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cyjei.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dkmtdj.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Edgqvqch.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ewnbwzml.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Frmzxhgdbr.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gcoosfgyq.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Goiyicukkt.tmp

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gutsoz.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hlkysy.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hzrohnjb.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Jpvytoxgk.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Lumjh.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mnwtrcw.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mobmrv.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxcygcbej.tmp

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ncajqts.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ncgngjsjz.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Negkmtdkw.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Nprogdwul.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Nwsmsn.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ojodw.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ojxmnllbck.tmp

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Prxluycphib.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Pxmovid.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qaqikmltoa.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	modified
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qfriiu.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qnzssrtix.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qrcyl.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qruxq.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sepivl.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sjksbgl.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sumoegih.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tgkuvbosdm.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tzgva.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ubcnfbmz.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Upgngqlau.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Uuciapjhqgf.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vvjlgxzn.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wuifubn.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Yktopcninho.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Zrdedvz.tmpdb

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Zwftrxlhf.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\notepad.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hvcfyay.ego.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dv2jdp32.0l1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2satjmq.4gq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_umypflq0.mfm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\notepad.exe

Download File

Process:	C:\Users\user\Desktop\payment_invoice.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	271204531
Entropy (8bit):	7.9999985604880255
Encrypted:	true
SSDEEP:	6291456:4+3STgcOxvt6dzBjEh3Svi8K8x/mWd8W/t6K2YkSR6dRiYoEFojrowu:F/ElSShK8BmSXVkF+zCoAf
MD5:	27970A76FAAD8CB3DB5DF74672ACC3CB
SHA1:	D9EB8525ECE985EB7530C651D1907BE1124CD786
SHA-256:	A7492588FA07D198B6E2CC98B0EA761C7C496706E4B0D461E8A3DA7856A8DB9D
SHA-512:	AC3E98A9626EDF650E3BD158A97D310D2C6270A52F199C34C6E739DBE430C428C7EBBB083CA0A76DDFA28C154AEC1A4BFA9839561E7D1382DDE01B68736FA6F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q#f.................@/.........6_/.. ...`/...@.. ......................../...........`..................................^/.L....`/......................./.....................................................D_/.............. ..H............text...L?/.. ...@/................. ..`.rsrc........`/......B/.............@..@.reloc......../......H/.............@..B................H.......T...............li...^...........................................0..........s................}O..........s.............s......~M...%:....&~L.........s....%.M...~N...:....~L.........s.....N...........(....}O....{O...o...............0..j...........(........(......9...........&..s........r...p(....r3..p(....o......s.......s...........s..........o......o......-.....9......o.......9......o.......9......o.......>......<......X.X.8U.....?......<+.....>.......o....8.........o......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.995507991199399
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	payment_invoice.exe
File size:	3'099'136 bytes
MD5:	af9695cf3142c1fe17e398bf452c290c
SHA1:	295d6df899de93ff4835b067c31c502ce894d92e
SHA256:	566a2a768b83757d7c2398bf9f1f84deef8bb4b238da9431fff343b262227c6b
SHA512:	104579b73feecf2f7349fad6c0b13f04831192f1466a64ab6c9c5f7003a07923ca49ba22f6d2ab1ee894c2718c64a3c959091443573ed40045a1a013a09967e2
SSDEEP:	49152:eE73wg9RmvKdLKXFxeLjwGh9riL9uoebQJ/aldMW62ZrqrGyIEpK:eEzb9RyXF8wc9WxAbQqB5Zur9s
TLSH:	8DE533C5EFD67662DB542B7E287B6BC406F6EC64E041C38F914E71EA188AFC15C48A0D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q#f.................@/.........6_/.. ...`/...@.. ......................../...........`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6f5f36
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x662351C9 [Sat Apr 20 05:25:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [006F5F44h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb byte ptr [edi+2Fh], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2f5ee8	0x4c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f6000	0x586	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f5f44	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2f3f4c	0x2f4000	d47cb2513a1d44df368b35effab61a60	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2f6000	0x586	0x600	8f81e621e068acc0400182524a49de5f	False	0.412109375	data	4.010361894340987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f8000	0xc	0x200	14051fd0c94e89c2c1e20d292f01d128	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2f6090	0x2fc	data			0.43455497382198954
RT_MANIFEST	0x2f639c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 15:21:42.353992939 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:42.549381018 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:42.549695015 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:47.580912113 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:47.828037024 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:47.828180075 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.073728085 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.074820995 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.074888945 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.074903965 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.074929953 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.074966908 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.074981928 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.075010061 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.075047016 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.075058937 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.075084925 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.075124025 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.075138092 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.075161934 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.075217962 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.270812988 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.270878077 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.270917892 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.270947933 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.270960093 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.270998955 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271007061 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.271039963 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271075964 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271090984 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.271117926 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271156073 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271167994 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.271194935 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271233082 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271245003 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.271270037 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271312952 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271323919 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.271352053 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271389008 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271399021 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.271428108 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271466017 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271476030 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.271506071 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271545887 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.271557093 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.317112923 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.467382908 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467447042 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467488050 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467528105 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467531919 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.467572927 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467592955 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.467612982 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467650890 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467658997 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.467694998 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467735052 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467745066 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.467772961 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467811108 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467822075 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.467849970 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467888117 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467900991 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.467926979 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467964888 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.467976093 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468005896 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468044043 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468058109 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468168020 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468209028 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468219995 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468247890 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468286037 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468302965 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468324900 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468362093 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468374014 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468401909 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468439102 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468450069 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468485117 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468528032 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468538046 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468565941 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468606949 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468620062 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468647957 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468684912 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468699932 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468723059 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468760014 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468770981 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468799114 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468836069 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468849897 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.468875885 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.468921900 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.513441086 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.513505936 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.513786077 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666121960 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666188002 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666227102 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666266918 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666310072 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666348934 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666353941 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666353941 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666393995 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666418076 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666438103 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666477919 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666517019 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666554928 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666594982 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666662931 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666702032 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666718960 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666719913 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666719913 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666739941 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666784048 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666799068 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666821957 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666830063 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666860104 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666899920 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666930914 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.666939974 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.666979074 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667011976 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667016983 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667056084 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667068005 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667093992 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667138100 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667155981 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667177916 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667218924 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667226076 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667258024 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667299032 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667310953 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667336941 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667375088 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667387962 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667414904 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667453051 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667464972 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667493105 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667531013 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667541027 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667571068 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667608976 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667622089 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667648077 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667685032 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667700052 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667723894 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667761087 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667776108 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667799950 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667838097 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667853117 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667876959 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667913914 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667943954 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.667952061 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667989969 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.667996883 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668029070 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668066025 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668081045 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668133974 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668173075 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668188095 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668210983 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668251038 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668262959 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668292046 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668330908 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668346882 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668369055 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668409109 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668420076 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668447018 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668484926 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668498993 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668524027 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668566942 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668576002 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668610096 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668647051 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668662071 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668685913 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668724060 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668737888 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668764114 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668801069 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668811083 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668839931 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668879032 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668891907 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.668920994 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668957949 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.668972969 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.669001102 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.669060946 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.710527897 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.710589886 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.710632086 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.710673094 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.710771084 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.710854053 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.865309000 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865380049 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865422010 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865461111 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865500927 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865547895 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865552902 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.865552902 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.865591049 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865622044 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.865631104 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865669966 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865695000 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.865709066 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865772963 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865813017 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865850925 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865889072 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865910053 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.865910053 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.865927935 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865967035 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.865974903 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.866003990 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866034031 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.866043091 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866080999 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866103888 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.866120100 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866158009 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866197109 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866235018 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866272926 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866312027 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866322041 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.866322994 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.866322994 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.866348982 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866388083 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866390944 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.866425991 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866462946 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:48.866477966 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:48.911005974 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:50.573888063 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:50.769582987 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:50.770050049 CEST	9817	49735	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:50.770153999 CEST	49735	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:56.312135935 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:21:56.506488085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:21:56.506634951 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:01.531191111 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:01.531267881 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:01.725466013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:01.725541115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:01.725558043 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:01.725585938 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:01.725605011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:01.725742102 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:01.920412064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:01.920443058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:01.920646906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.115088940 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115149975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115186930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115220070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115253925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115252972 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.115353107 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115367889 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.115367889 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.115389109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115422964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115454912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115488052 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115638018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115672112 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115756989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.115833044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.170201063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.310570955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.310632944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.310651064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.310664892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.310681105 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.310697079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.310713053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.539083004 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.779731035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:02.779809952 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.808968067 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.809129000 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:02.809191942 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:03.003458977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.003721952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.003757000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.003783941 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:03.003793001 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.003825903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.003942966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.003977060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004009962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004092932 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004302025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004338980 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004370928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004404068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004496098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004529953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004657030 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004740000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.004947901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005049944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005269051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005301952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005424976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005533934 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005568027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005654097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005739927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005834103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005923033 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.005961895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.006058931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.006155014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.006290913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.061078072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.061173916 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:03.198014975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.198318958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.295473099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.556245089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.598401070 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:03.792907000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:03.832811117 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:15.410113096 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:15.655811071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:15.655981064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:15.904967070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.037934065 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.039016008 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.039167881 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.039297104 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.039407015 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.039558887 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.233537912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233596087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233630896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233663082 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233660936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.233700037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233721972 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.233735085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233771086 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233782053 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.233838081 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.233889103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233922005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.233941078 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234040976 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234091997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.234163046 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234210014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.234276056 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234384060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.234453917 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234539986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.234601021 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234698057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.234771967 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234772921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.234837055 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234893084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.234956026 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.234968901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235018969 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235054970 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235116005 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235249043 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235301971 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235322952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235383034 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235439062 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235502005 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235513926 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235563993 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235639095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235707045 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235713959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235778093 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235831976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235893011 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235908031 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.235966921 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.235985041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236043930 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236063004 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236146927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236205101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236255884 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236279964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236336946 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236356974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236408949 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236474991 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236546040 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236634016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236694098 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236790895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236824036 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.236870050 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.236938000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237004042 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237015963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237083912 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237093925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237149954 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237206936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237267017 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237324953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237373114 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237482071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237514973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237543106 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237576962 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237595081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237651110 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237715006 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237778902 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.237910986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.237972021 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238066912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238122940 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238142014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238174915 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238199949 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238241911 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238291979 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238347054 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238367081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238425970 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238446951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238501072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238560915 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238621950 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238677025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238744020 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238790035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238845110 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.238945961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.238980055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239008904 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239053011 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239054918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239120960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239130974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239181042 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239206076 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239270926 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239320993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239386082 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239394903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239465952 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239470959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239528894 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.239711046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239743948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.239793062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.427999973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428052902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428090096 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428148031 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428178072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.428203106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428236008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428261995 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.428270102 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428311110 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.428342104 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.428721905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428755045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428777933 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.428816080 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.428891897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.428973913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.428976059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429020882 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.429135084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429186106 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.429250956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429303885 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.429367065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429425001 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.429522038 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429574966 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.429594994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429645061 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.429790974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429867029 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.429874897 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.429924965 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.430066109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.430118084 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.430260897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.430314064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.430382967 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.430442095 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.430619001 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.430653095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.430670977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.430706024 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.430890083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.430948019 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.430964947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431011915 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431040049 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431071997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431101084 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431132078 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431310892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431369066 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431384087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431457996 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431458950 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431514978 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431571960 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431623936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431646109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431694031 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431879044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.431931973 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.431951046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.432003021 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.432133913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.432180882 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.432209969 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.432261944 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.432329893 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.432379961 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.432483912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.432543039 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.432605028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.432653904 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.432841063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.432894945 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.432955027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433001041 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.433109999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433141947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433171034 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.433203936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.433298111 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433331013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433355093 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.433388948 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.433485985 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433537006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.433559895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433614969 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.433963060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.433995962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434014082 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434073925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434082985 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434137106 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434148073 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434200048 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434263945 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434314966 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434377909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434410095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434442997 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434479952 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434525013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434576035 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434639931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434698105 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434838057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434886932 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434911013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.434959888 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.434988022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435019970 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435043097 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435051918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435092926 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435106039 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435141087 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435487986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435569048 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435656071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435688972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435709000 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435722113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435741901 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435780048 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435878038 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435909986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435935974 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435940981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.435972929 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.435973883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436001062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436037064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436090946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436156034 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436171055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436213970 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436242104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436289072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436297894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436352015 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436422110 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436469078 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436476946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436523914 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436528921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436572075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436645985 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436691999 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436701059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436750889 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436774015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436817884 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.436845064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.436891079 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437057972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437104940 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437113047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437184095 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437220097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437272072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437366009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437381983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437417030 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437427044 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437458992 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437469959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437516928 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437593937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437644958 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437685966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437701941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437747002 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437845945 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437891960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437937021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.437983990 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.437993050 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438039064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438101053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438154936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438209057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438224077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438262939 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438313007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438352108 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438400984 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438442945 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438453913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438493967 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438524961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438564062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438668013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438683987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438709974 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438728094 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.438946962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438962936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438977957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.438988924 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439004898 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439023972 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439068079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439102888 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439115047 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439143896 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439237118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439277887 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439349890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439393044 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439404964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439450026 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439459085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439496040 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439682961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439698935 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439714909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439728022 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439757109 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439786911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439831018 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439893961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439909935 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439941883 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.439981937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.439997911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440037012 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440088987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440114975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440135956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440150976 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440150976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440197945 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440206051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440249920 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440355062 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440391064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440395117 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440432072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440448999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440464020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440510988 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440587997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440625906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440696955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440747023 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440771103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440785885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440814018 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440836906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440875053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.440924883 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.440984011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.441023111 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.441082954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.441097975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.441138983 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.441149950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.441184998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.441185951 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.441225052 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.441277027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.441322088 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.441368103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.441406965 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.628062010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628151894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628185987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628272057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628304958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628338099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628367901 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.628387928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628443003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628475904 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628509045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628546953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628580093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628612041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628618956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.628647089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628679991 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628711939 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628730059 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.628743887 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628777981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628787041 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.628813028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628818989 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.628846884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.628900051 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.628966093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629002094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629065990 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629125118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629158020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629188061 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629229069 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629239082 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629300117 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629354000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629422903 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629508972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629575968 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629703999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629736900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629769087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629776001 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629803896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629837990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629839897 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629914045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.629920006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.629945993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630006075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630023956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630099058 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630280018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630366087 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630397081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630467892 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630518913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630598068 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630635977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630667925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630697012 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630697966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630734921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630739927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630795956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630810022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630856037 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.630923986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.630986929 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631321907 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631354094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631385088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631386042 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631417036 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631444931 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631525993 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631575108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631608963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631633997 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631642103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631668091 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631675959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631709099 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631710052 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631742954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631748915 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631773949 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631800890 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631805897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631839037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.631875992 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.631930113 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632139921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632173061 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632205009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632221937 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632236958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632271051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632303953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632318974 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632335901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632369041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632401943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632433891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632499933 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632508993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632585049 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632592916 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632617950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632674932 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632695913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632730007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632759094 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632762909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632805109 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632839918 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632843018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632874966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632905006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632950068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.632955074 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.632982016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633003950 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633044958 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633058071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633090973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633110046 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633158922 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633207083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633239031 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633266926 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633308887 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633434057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633508921 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633548021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633579969 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633641005 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633697033 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633732080 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633760929 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633764029 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633830070 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633840084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.633888006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.633958101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634021997 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634073973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634147882 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634149075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634208918 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634222984 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634255886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634294987 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634332895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634341955 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634366989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634398937 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634438038 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634442091 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634475946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634522915 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634550095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634614944 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634627104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634661913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634696007 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634735107 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634737015 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634789944 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634809971 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634866953 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634886026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634918928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634942055 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634953022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.634984970 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.634985924 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635039091 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635060072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635093927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635123014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635160923 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635166883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635231972 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635241985 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635299921 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635317087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635377884 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635518074 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635593891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635600090 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635660887 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635721922 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635802984 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635838032 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635909081 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635910988 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.635986090 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.635993958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.636046886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.636059999 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.636132956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.636234045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.636322021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.636327982 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.636392117 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.636447906 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.636529922 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.636595011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.636651039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.636670113 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.636720896 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.636991024 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.637075901 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.637154102 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.637208939 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.637228966 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.637294054 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.637444019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.637507915 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.637643099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.637729883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.637734890 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.637816906 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.637825012 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.637900114 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.638031006 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.638123035 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.638197899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.638245106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.638300896 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.638334036 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.638350010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.638410091 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.638848066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.638916016 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.638973951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.639077902 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.639081955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.639194012 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.639333963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.639435053 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.639972925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.639988899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.640073061 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.640264988 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.640300989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.640397072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.640682936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.640712976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.640796900 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641202927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641218901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641232967 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641247988 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641315937 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641336918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641351938 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641352892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641370058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641427040 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641470909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641488075 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641505003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641511917 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641511917 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641511917 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641513109 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641520977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641513109 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641568899 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641568899 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641616106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641632080 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641648054 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641659975 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641681910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641694069 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641697884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641714096 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641724110 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641731024 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641746998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641752958 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641762018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641783953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641789913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641799927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641817093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641823053 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641833067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641844988 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641849995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.641874075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.641892910 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823385000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823445082 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823479891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823503971 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823513031 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823548079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823582888 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823592901 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823616982 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823632956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823656082 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823688984 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823720932 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823720932 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823741913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823754072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823785067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823813915 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823817968 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823834896 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823851109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823865891 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823899984 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823916912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823950052 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.823961973 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.823983908 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824016094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824034929 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824069023 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824157953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824193954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824218988 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824228048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824260950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824270010 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824429989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824461937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824484110 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824510098 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824541092 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824683905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824717999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824734926 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824753046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824779034 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824906111 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824938059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.824958086 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.824995041 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825072050 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825103998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825124025 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825134993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825167894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825197935 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825198889 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825222969 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825232983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825263023 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825278044 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825294971 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825320005 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825328112 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825376987 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825778008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825810909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825836897 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825843096 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825856924 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825875998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825907946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.825923920 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.825961113 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.826179981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826212883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826261997 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.826327085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826359987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826380968 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.826432943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826482058 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.826685905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826740980 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.826823950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826855898 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826874971 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.826889038 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.826936960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827048063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827080965 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827100039 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827141047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827174902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827192068 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827229023 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827250004 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827281952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827332973 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827395916 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827429056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827446938 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827470064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827613115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827646971 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827699900 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827708006 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827744007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827760935 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827779055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827826977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.827893972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827927113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.827945948 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.828039885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.828089952 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.828198910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.828236103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.828249931 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.828269005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.828289032 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.828303099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.828351974 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.828429937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.828476906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.828542948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.828979015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829035997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829050064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829078913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829091072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829116106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829149008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829161882 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829180956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829195023 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829236984 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829299927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829333067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829365015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829379082 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829397917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829412937 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829533100 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829565048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829585075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829597950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829621077 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829634905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829668045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829680920 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829700947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829720020 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829745054 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829777002 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829890013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829938889 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.829962969 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.829996109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830018044 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830029011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830061913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830077887 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830096006 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830102921 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830131054 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830183983 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830286980 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830318928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830339909 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830352068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830363989 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830385923 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830419064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830435991 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830451965 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830467939 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830485106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830517054 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830539942 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830549002 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830562115 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830583096 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830615997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830638885 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830651045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830660105 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830682993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830697060 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830715895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830739021 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830749989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830761909 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830782890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830815077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830830097 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830864906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830888987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830941916 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.830961943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.830995083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831012964 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831027985 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831048012 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831059933 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831093073 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831106901 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831126928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831156969 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831160069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831192017 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831213951 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831223965 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831243038 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831258059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831289053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831302881 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831321955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831353903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831362009 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831384897 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831386089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831403017 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831420898 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831439018 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831451893 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831482887 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831501961 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831515074 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831525087 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831547022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831578970 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831595898 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831610918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831625938 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831645012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831662893 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831677914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831685066 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831728935 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831793070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831844091 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831867933 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831902027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.831918001 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.831957102 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832014084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832062960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832087994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832138062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832149029 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832181931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832201958 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832215071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832242966 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832247972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832267046 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832281113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832293987 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832314014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832334042 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832345963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832354069 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832379103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832396984 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832412004 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832436085 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832443953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832459927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832478046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832494020 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832509995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832525969 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832541943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832572937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832588911 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832606077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832613945 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832639933 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832657099 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832674026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832691908 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832707882 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832730055 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832740068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832773924 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832804918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832823992 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832837105 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832844973 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832868099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832881927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832901001 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832910061 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832933903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832966089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.832981110 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.832999945 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833018064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833031893 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833064079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833081007 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833096981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833118916 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833128929 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833161116 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833172083 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833194017 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833210945 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833226919 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833234072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833260059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833275080 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833292961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833307028 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833326101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833332062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833359957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833374977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833395004 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833415031 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833427906 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833437920 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833461046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833477974 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833492041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833508015 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833523035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833538055 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833554983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833585978 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833600998 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833620071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833642960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833656073 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833667994 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833692074 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833699942 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833724976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833745956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833759069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833770037 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833791971 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833806038 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833823919 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833837986 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833857059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833874941 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833889008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833918095 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833934069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833956957 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.833967924 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.833978891 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834000111 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834012032 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834033012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834048033 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834065914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834084988 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834098101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834124088 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834132910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834165096 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834180117 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834197044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834216118 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834228039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834237099 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834260941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834290981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834309101 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834323883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834332943 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834356070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834371090 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834389925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834403992 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834424019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834471941 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834681034 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834713936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834737062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834747076 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834758043 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834779978 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834810019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834824085 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834842920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834865093 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834876060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834909916 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834925890 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834943056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.834955931 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.834976912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835009098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835025072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835041046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835063934 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835074902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835095882 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835108042 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835140944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835156918 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835175037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835189104 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835207939 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835222960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835241079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835254908 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835273981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835293055 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835304976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835319042 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835354090 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835380077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835412025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835429907 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835444927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835455894 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835478067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835494995 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835510969 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835525990 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835542917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835560083 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835577011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835588932 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835617065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835644007 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835654974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835668087 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835688114 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835702896 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835721970 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835745096 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835756063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835769892 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835789919 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835805893 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835823059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835835934 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835855961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835871935 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835891008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835903883 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835922956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835937977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835954905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835977077 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.835988998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.835997105 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836020947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836034060 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836054087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836071014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836085081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836098909 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836133957 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836136103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836167097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836182117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836188078 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836199045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836215019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836215019 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836230993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836236000 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836246967 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836256981 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836266041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836282015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836285114 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836297989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836303949 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836313963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836328983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836324930 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836344957 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836385965 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836443901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836461067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836476088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836492062 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836493969 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836508989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836519003 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836527109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836544037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836549997 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836559057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836574078 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836574078 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836595058 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836623907 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836844921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836898088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836903095 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.836951017 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836966991 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836982012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.836998940 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837024927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837053061 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837088108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837102890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837101936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837132931 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837137938 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837153912 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837192059 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837254047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837270975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837285995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837301016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837301970 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837317944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837323904 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837352037 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837352037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837389946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837398052 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837405920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837433100 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837454081 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837459087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837495089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837507963 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837531090 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837542057 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837584019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837618113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837630033 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837634087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837655067 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837677956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837702990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837718964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837753057 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837791920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837807894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837822914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837838888 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837852001 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837855101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837882042 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837889910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837907076 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837907076 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837929964 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.837944984 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.837949038 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838000059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838047028 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838053942 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838100910 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838109016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838125944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838141918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838156939 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838170052 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838175058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838191032 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838196039 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838217974 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838226080 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838237047 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838242054 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838275909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838279009 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838318110 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838327885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838344097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838359118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838383913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838407993 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838429928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838445902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838473082 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838494062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838500977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838517904 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838546038 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838551998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838567972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838594913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838614941 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838620901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838638067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838653088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838670969 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838674068 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838697910 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838742971 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838758945 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838774920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838788986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838788986 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838805914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838815928 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.838824034 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.838857889 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839086056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839142084 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839159012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839174032 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839209080 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839243889 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839258909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839287996 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839310884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839310884 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839328051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839343071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839359999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839361906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839384079 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839413881 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839430094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839445114 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839461088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839463949 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839488029 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839508057 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839534044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839550018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839564085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839572906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839579105 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839596033 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839598894 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839612007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839618921 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839629889 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839641094 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839647055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839662075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839663982 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839679956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839694023 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839719057 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839741945 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839756966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839771986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839787960 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839802980 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839823008 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839840889 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839857101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839871883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839885950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839890957 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839900970 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839912891 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839915991 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839932919 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839936972 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839948893 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839962006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.839965105 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.839984894 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840003967 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840071917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840089083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840112925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840131044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840132952 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840146065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840162039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840162039 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840178013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840184927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840195894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840212107 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840212107 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840228081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840243101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840246916 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840260029 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840270996 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840276957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840293884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840296030 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840308905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840326071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840328932 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840342045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840354919 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840358973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840374947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840379000 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840390921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840403080 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840406895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840420961 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840424061 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840440035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840442896 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840456963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840472937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840473890 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840487957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840503931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840519905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840523958 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840534925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840550900 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840572119 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840605974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840621948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840645075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840668917 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840730906 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840749025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840764046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840779066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840779066 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840792894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840806007 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840811014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840826988 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840827942 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840842962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840857029 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840857983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840873957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840879917 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840890884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840899944 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840907097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840924025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840929031 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840939999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840950012 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840956926 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840969086 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.840972900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840990067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.840998888 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841006994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841023922 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841025114 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841039896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841044903 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841057062 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841064930 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841073990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841087103 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841090918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841108084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841114044 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841124058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841135025 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841140985 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841156006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841157913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841180086 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841197014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841212988 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841228962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841244936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841259003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841274977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841289043 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841289997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841319084 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841341972 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841344118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841361046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841376066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841387033 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841392040 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841414928 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841432095 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841447115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841834068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841849089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841864109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841896057 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841933012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841948986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841963053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841978073 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.841979980 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.841993093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842005014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842030048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842034101 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842046022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842076063 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842097044 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842098951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842171907 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842185974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842200994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842215061 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842221022 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842231035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842248917 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842256069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842273951 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842293024 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842300892 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842308998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842343092 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842350960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842387915 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842396975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842412949 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842441082 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842470884 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842710972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842760086 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842854977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842870951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842886925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842900038 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842904091 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842921019 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842921972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842957973 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842977047 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.842978001 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.842993975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843008995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843035936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843060970 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843080044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843097925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843105078 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843118906 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843147039 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843156099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843172073 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843247890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843262911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843277931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843292952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843307972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843312025 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843312979 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843322039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843341112 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843365908 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843390942 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843419075 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843435049 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843472004 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843472958 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843487978 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843503952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843518019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843527079 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843527079 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843550920 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843556881 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843569040 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843594074 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843607903 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843610048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843627930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843632936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843643904 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843667030 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843667030 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843667030 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843692064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843707085 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843744040 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843745947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843761921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843789101 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843808889 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843816042 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843852997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843861103 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843898058 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843905926 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843923092 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843939066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.843950033 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843988895 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.843993902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844011068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844048023 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844063997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844079971 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844124079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844132900 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844141006 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844177008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844203949 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844247103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844263077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844279051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844285965 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844295025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844310045 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844314098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844330072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844345093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844345093 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844376087 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844398022 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844419956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844435930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844472885 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844489098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844506025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844532013 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844557047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844572067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844580889 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844608068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844625950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844644070 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844664097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844683886 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844683886 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844707966 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844718933 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844733953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.844768047 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.844985962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845032930 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845077991 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845113039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845125914 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845128059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845156908 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845189095 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845216990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845232964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845247984 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845261097 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845263958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845279932 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845293045 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845321894 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845351934 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845367908 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845393896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845406055 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845412016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845428944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845444918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845483065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845498085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845505953 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845514059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845551014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845567942 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845582962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845585108 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845598936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845621109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845638037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845653057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845669031 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845685005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845686913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845700026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845736980 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845752954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845760107 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845768929 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845786095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845802069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845817089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845839977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845839977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845839977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845870018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845886946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845901966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845916986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845932007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845937014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845937014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845937014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845937014 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.845947981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845964909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845982075 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.845998049 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846014023 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846014023 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846029997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846046925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846062899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846081018 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846106052 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846155882 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846172094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846187115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846199989 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846201897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846224070 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846270084 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846276045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846292973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846307993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846323967 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846328974 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846338987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846354008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846369982 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846385956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846401930 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846421003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846437931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846452951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846460104 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846461058 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846467972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846498013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846524000 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846524954 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846560001 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846560955 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846596956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846668959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846685886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846700907 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846709967 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846731901 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846735954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846744061 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846752882 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846769094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846777916 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846785069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846791029 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846818924 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846909046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846924067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846939087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846956015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846963882 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846971989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846983910 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.846987963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.846996069 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847004890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847012997 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847023010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847038031 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847045898 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847054005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847063065 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847069979 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847084999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847091913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847100973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847111940 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847116947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847134113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847135067 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847148895 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847150087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847167015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847176075 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847182035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847196102 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847198963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847208977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847208977 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847217083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847224951 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847234011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847249985 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847251892 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847251892 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847270012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847271919 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847286940 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847285986 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847286940 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847301960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847304106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847312927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847321033 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847336054 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847347021 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847347021 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847352028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847376108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847378016 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847390890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847394943 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847408056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847423077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847428083 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847428083 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847439051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847444057 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847455978 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847470999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847474098 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847486019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847491026 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847501993 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847503901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847533941 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847552061 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847611904 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847628117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847642899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847659111 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847660065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847671986 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847671986 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847702026 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847702026 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847732067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847747087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847764015 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847780943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847795963 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847796917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847811937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847824097 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847836971 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847848892 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847883940 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847899914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847914934 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847928047 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847929955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.847939968 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.847979069 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.848004103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.848018885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.848033905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.848037004 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.848050117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.848064899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.848067045 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.848081112 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.848097086 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:16.848107100 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.848134041 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.848144054 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:16.942332983 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.018336058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018393993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018430948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018464088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018495083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018528938 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018560886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018594027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018625021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018659115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018714905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.018748045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019382000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019442081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019475937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019509077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019541025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019576073 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019608021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019643068 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019675970 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.019752979 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020205975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020263910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020298958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020332098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020365000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020397902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020430088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020462036 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020529032 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020801067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.020859957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021084070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021116972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021147966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021179914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021210909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021241903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021450996 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021568060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021625042 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.021692991 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.022054911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.022125006 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.022243977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.022275925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.022306919 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023035049 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023169994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023261070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023377895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023566008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023627043 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023785114 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023941040 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.023973942 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.024549007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.024749994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.025381088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.025413990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.025532007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.025563955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.025676966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.025779009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.028316021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.028404951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.028438091 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.028521061 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.028553009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.029700994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030131102 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030210972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030242920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030477047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030509949 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030541897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030572891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030607939 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030641079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030709028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030741930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030772924 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030824900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030857086 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030900002 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030932903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030963898 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.030994892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031025887 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031055927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031089067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031121016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031152010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031183958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031213999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031245947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031276941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031349897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031383038 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031418085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031528950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031559944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031594992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031712055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031744957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031776905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031852961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031920910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031954050 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.031985998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032017946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032051086 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032080889 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032138109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032170057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032202959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032233000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032264948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032295942 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032329082 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032360077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032391071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032422066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032453060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032486916 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032517910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032550097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032582045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032613993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032742977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032776117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032808065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032839060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032871008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032902002 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032932997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032963991 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.032994986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033051014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033083916 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033114910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033144951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033175945 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033206940 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033237934 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033268929 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033299923 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033330917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033361912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033392906 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033422947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033453941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033484936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033516884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033591032 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033649921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033683062 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033714056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033783913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033816099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033893108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033925056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033956051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.033987045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034018993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034054995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034182072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034285069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034317017 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034368992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034400940 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034492016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034523964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034555912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034840107 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.034982920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035015106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035146952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035178900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035243988 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035276890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035309076 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035340071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035419941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035453081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035484076 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035515070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035546064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035577059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035655975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035689116 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035721064 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035751104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035820007 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035854101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035885096 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035916090 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035947084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.035978079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036025047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036056042 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036087036 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036135912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036170959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036201000 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036232948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036263943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036294937 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036326885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036359072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036390066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036422014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036453009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036484003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036514997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036545992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036576986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036608934 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036642075 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036673069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036703110 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036734104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036765099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036880016 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036912918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036943913 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.036974907 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037005901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037036896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037066936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037097931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037128925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037159920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037189960 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037221909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037252903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037282944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037411928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037442923 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037473917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037506104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037537098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037568092 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037599087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037631035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037662983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037694931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037725925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037756920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037787914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037817955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037849903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037879944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037911892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037942886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.037974119 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038005114 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038036108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038067102 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038098097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038130999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038163900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038194895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038224936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038296938 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038328886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038409948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038441896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038472891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038503885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038537025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038721085 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038852930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038886070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038917065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038949013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.038980961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039012909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039042950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039073944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039104939 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039135933 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039166927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039197922 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039228916 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039259911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039290905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039321899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039352894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039383888 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039414883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039446115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039477110 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039509058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039540052 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039624929 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039657116 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039688110 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039720058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039752960 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039784908 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039814949 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039846897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039877892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039908886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039940119 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.039971113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040002108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040033102 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040065050 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040096045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040143967 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040174961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040205956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040262938 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040347099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040376902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040409088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040503025 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040534973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040566921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040599108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040631056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040662050 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040693045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040724039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040755033 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040786028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040817022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.040848017 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041232109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041264057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041296005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041374922 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041491032 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041522026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041554928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041587114 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041619062 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041651964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041683912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041714907 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041747093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041779041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041865110 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041897058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.041939974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042045116 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042078018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042109013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042140961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042330027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042361021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042376995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042408943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042442083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042471886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042505026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042536020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042566061 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042598009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042629957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042661905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042692900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042726040 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042757034 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042788982 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042820930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042853117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042884111 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042915106 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042946100 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.042978048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043008089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043040037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043071032 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043102026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043133020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043164968 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043195963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043226957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043257952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043287992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043318987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043349981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043380022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043410063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043441057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043472052 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043503046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043534040 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043565989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043596983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043629885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043662071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043693066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043724060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043755054 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043792963 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043828964 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043860912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043891907 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043922901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043955088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.043986082 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044017076 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044048071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044080019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044131041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044162035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044193029 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044225931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044256926 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044287920 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044318914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044349909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044380903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044413090 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044444084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044473886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044503927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044519901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044550896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044581890 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044611931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044645071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.044676065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045222044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045387983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045418978 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045452118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045557976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045589924 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045627117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045664072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045695066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045727015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045758009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045789003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045819998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045850992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045881987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045912027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045943022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045973063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.045988083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046001911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046016932 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046030998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046046019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046061039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046076059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046089888 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046104908 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046118975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046133995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046216011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046233892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046288013 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046303034 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046319008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046334028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046361923 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046375990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046391010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046405077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046420097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046435118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046448946 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046463966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046478987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046493053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046508074 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046523094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046538115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046552896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046567917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046581984 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046597004 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046612024 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046668053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.046684027 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047143936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047159910 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047174931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047190905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047204971 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047234058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047362089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047377110 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047391891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047405958 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047420979 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047435999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047451019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047593117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047609091 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047624111 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047661066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047729015 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047744989 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047821045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047836065 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047851086 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047875881 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047890902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047928095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047943115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.047988892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048003912 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048049927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048149109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048163891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048180103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048194885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048253059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048316002 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048331976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048403978 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048441887 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048456907 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048471928 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048541069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048556089 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048648119 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048662901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048683882 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048700094 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048763037 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048778057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048794985 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048856974 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048871994 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048887014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.048968077 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049020052 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049036026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049104929 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049160957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049176931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049216986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049294949 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049310923 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049359083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049375057 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049390078 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049420118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049460888 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049582005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049597979 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049613953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049711943 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049729109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049807072 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049822092 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049837112 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049851894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049866915 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049964905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.049981117 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050009966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050024986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050040960 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050055981 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050071955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050086021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050127029 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050141096 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050157070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050170898 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050187111 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050200939 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050215960 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050231934 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050288916 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050343990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050384045 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050403118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050417900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050488949 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050504923 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050520897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050590992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050606966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050621033 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050635099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050688028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050704002 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050791979 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050806999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050822020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050856113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050896883 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050911903 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050925970 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.050941944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051014900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051031113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051047087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051134109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051150084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051165104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051179886 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051192999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051208019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051223040 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051255941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051270962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051285982 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051325083 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051368952 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051383972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051422119 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051497936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051512957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051527977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051542997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.051600933 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.136820078 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.136965036 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.331640005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.331706047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.331939936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.526422024 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.526482105 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.526516914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.526621103 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.721143961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.721568108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.721626997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.723159075 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.723460913 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918116093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918174982 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918207884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918242931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918275118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918307066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918340921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918358088 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918371916 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918405056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918427944 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918440104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918451071 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918473005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918494940 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918507099 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918521881 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918540955 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918565989 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918575048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918582916 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918607950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918628931 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918644905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:17.918661118 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:17.918706894 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.113116026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113177061 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113212109 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113245010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113271952 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.113281965 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113316059 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113351107 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113364935 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.113383055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113415003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113447905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113542080 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113574028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113606930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113641977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113673925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113738060 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113771915 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113805056 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113837004 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113872051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113873959 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.113898993 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.113904953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113925934 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.113940954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113960981 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.113975048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.113991976 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.114007950 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114039898 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114046097 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.114072084 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114073038 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.114098072 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.114104986 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114137888 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114168882 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114201069 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114232063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114263058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114295006 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.114326954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.308801889 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.308862925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.308897018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.308933020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.308964968 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.308998108 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309031010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309062004 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309097052 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309128046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309132099 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309160948 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309195042 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309210062 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309228897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309250116 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309272051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309297085 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309307098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309324980 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309343100 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309357882 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309376001 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309392929 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309410095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309429884 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309444904 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309463978 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309478998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309494019 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309514046 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309531927 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309547901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309571981 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309581041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309597969 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309614897 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309632063 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309652090 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309668064 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309684992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309704065 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309719086 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309731960 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309752941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309768915 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309784889 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309813976 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309840918 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309906960 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309942961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.309974909 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.309976101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.310009003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.310009956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.310043097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.310045958 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.310075998 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.310080051 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.310108900 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.310142040 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.310272932 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.504955053 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505065918 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505099058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505116940 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.505132914 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505156994 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.505166054 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505182981 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.505194902 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.505201101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505232096 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.505234003 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505268097 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505275011 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.505300999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505332947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505364895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505397081 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505429029 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505461931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505494118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505525112 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505558014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505589008 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505629063 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505666018 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505697012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505736113 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505767107 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505799055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505834103 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505866051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505897999 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505928993 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505959988 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.505991936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506022930 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506053925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506086111 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506117105 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506148100 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506180048 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506211996 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506243944 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506275892 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506306887 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506337881 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506367922 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506401062 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506433010 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506464005 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506495953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506526947 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506561995 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506594896 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506625891 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506659031 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506690979 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506725073 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506757021 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506788969 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506820917 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506853104 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506884098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506915092 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506947041 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.506978035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507009983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507040977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507074118 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507106066 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507138014 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507168055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507200956 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507231951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507262945 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507294893 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507327080 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507359028 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507390022 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507421017 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507452011 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507483959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507514954 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507546902 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507579088 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.507611990 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.509221077 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.509222031 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.509274006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.509274006 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.701948881 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702007055 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702040911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702074051 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702106953 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702138901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702179909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702212095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702244043 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702305079 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702392101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702425957 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702456951 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702488899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702519894 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702552080 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702584982 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702615976 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702651024 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702682972 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702713966 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702744961 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702776909 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702809095 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702841043 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702872992 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702904940 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702949047 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.702991962 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703023911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703039885 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703054905 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703069925 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703104973 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703136921 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703167915 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703202009 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703234911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703316927 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703350067 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703382969 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703490019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703649044 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703689098 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703720093 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703751087 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703783035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703814983 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703846931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.703922987 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704035997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704068899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704123020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704159975 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704193115 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704224110 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704315901 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704346895 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704379082 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704408884 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704441071 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704473019 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.704504967 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.705213070 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.705899954 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.705971956 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706046104 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706115961 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706156015 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706238031 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706274033 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706325054 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706418991 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706553936 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.706588030 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.902730942 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.902853012 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.902959108 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.902988911 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903027058 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903036118 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903059959 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903062105 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903093100 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903101921 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903129101 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903161049 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903192997 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903199911 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903225899 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903254986 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903259039 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903285027 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903291941 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903311968 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903326035 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903358936 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903389931 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903409004 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903424978 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903441906 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903460026 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903491020 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903491020 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903523922 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903523922 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903642893 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903695107 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903773069 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903774977 CEST	9817	49737	91.92.255.61	192.168.2.4
Apr 20, 2024 15:22:18.903898954 CEST	49737	9817	192.168.2.4	91.92.255.61
Apr 20, 2024 15:22:18.903940916 CEST	9817	49737	91.92.255.61	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 20, 2024 15:21:42.213174105 CEST	192.168.2.4	1.1.1.1	0xd907	Standard query (0)	purfufu3flujs.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 20, 2024 15:21:51.030704975 CEST	192.168.2.4	1.1.1.1	0xebfd	Standard query (0)	10.76.9.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Apr 20, 2024 15:22:28.882081032 CEST	192.168.2.4	1.1.1.1	0xf1c1	Standard query (0)	10.76.9.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Apr 20, 2024 15:22:51.659090042 CEST	192.168.2.4	1.1.1.1	0x7e4e	Standard query (0)	purfufu3flujs.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 20, 2024 15:22:58.643099070 CEST	192.168.2.4	1.1.1.1	0x50f7	Standard query (0)	10.76.9.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Apr 20, 2024 15:23:32.058902979 CEST	192.168.2.4	1.1.1.1	0x74c6	Standard query (0)	10.76.9.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 20, 2024 15:21:42.351141930 CEST	1.1.1.1	192.168.2.4	0xd907	No error (0)	purfufu3flujs.duckdns.org		91.92.255.61	A (IP address)	IN (0x0001)	false
Apr 20, 2024 15:21:51.135876894 CEST	1.1.1.1	192.168.2.4	0xebfd	Name error (3)	10.76.9.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Apr 20, 2024 15:22:28.987814903 CEST	1.1.1.1	192.168.2.4	0xf1c1	Name error (3)	10.76.9.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Apr 20, 2024 15:22:51.796559095 CEST	1.1.1.1	192.168.2.4	0x7e4e	No error (0)	purfufu3flujs.duckdns.org		91.92.255.61	A (IP address)	IN (0x0001)	false
Apr 20, 2024 15:22:58.748670101 CEST	1.1.1.1	192.168.2.4	0x50f7	Name error (3)	10.76.9.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Apr 20, 2024 15:23:32.164699078 CEST	1.1.1.1	192.168.2.4	0x74c6	Name error (3)	10.76.9.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	15:20:56
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\payment_invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\payment_invoice.exe"
Imagebase:	0x3b0000
File size:	3'099'136 bytes
MD5 hash:	AF9695CF3142C1FE17E398BF452C290C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2116746974.00000000071A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2102278081.0000000004733000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2111959813.0000000005220000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2099128465.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2099128465.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2099128465.0000000002BB2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:21:40
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\payment_invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\payment_invoice.exe"
Imagebase:	0x590000
File size:	3'099'136 bytes
MD5 hash:	AF9695CF3142C1FE17E398BF452C290C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000004.00000002.2607868288.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.2590736459.0000000005250000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.2518262615.0000000004651000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2601872712.00000000054F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2508485211.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2604821885.0000000005740000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:21:43
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\notepad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\notepad.exe"
Imagebase:	0x8a0000
File size:	271'204'531 bytes
MD5 hash:	27970A76FAAD8CB3DB5DF74672ACC3CB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2484397590.0000000002E83000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000002.2489840693.0000000004324000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2484397590.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:21:51
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\notepad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\notepad.exe"
Imagebase:	0xad0000
File size:	271'204'531 bytes
MD5 hash:	27970A76FAAD8CB3DB5DF74672ACC3CB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2581231238.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2581231238.00000000030E4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2607816073.0000000004638000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2581231238.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2607816073.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:22:02
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\user\Desktop\payment_invoice.exe"' -PropertyType 'String'
Imagebase:	0x900000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:22:02
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:22:15
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\payment_invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\payment_invoice.exe"
Imagebase:	0x370000
File size:	3'099'136 bytes
MD5 hash:	AF9695CF3142C1FE17E398BF452C290C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2822552993.0000000002A04000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2822552993.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2822552993.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:22:19
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\notepad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\notepad.exe"
Imagebase:	0x900000
File size:	271'204'531 bytes
MD5 hash:	27970A76FAAD8CB3DB5DF74672ACC3CB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3100460918.0000000004991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2833438076.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:22:24
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\payment_invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\payment_invoice.exe"
Imagebase:	0x150000
File size:	3'099'136 bytes
MD5 hash:	AF9695CF3142C1FE17E398BF452C290C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:22:27
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\notepad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\notepad.exe"
Imagebase:	0x7a0000
File size:	271'204'531 bytes
MD5 hash:	27970A76FAAD8CB3DB5DF74672ACC3CB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:22:40
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'notepad' -Value '"C:\Users\user\AppData\Local\notepad.exe"' -PropertyType 'String'
Imagebase:	0x900000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:22:40
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:22:49
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\payment_invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\payment_invoice.exe"
Imagebase:	0x760000
File size:	3'099'136 bytes
MD5 hash:	AF9695CF3142C1FE17E398BF452C290C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5%
Total number of Nodes:	418
Total number of Limit Nodes:	19

Executed Functions

Function 00EFDDE8 Relevance: 3.6, Strings: 2, Instructions: 1081
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 00EFE2E8
2, xrefs: 00EFE928

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 2$$^q
API String ID: 0-1071376767
Opcode ID: a8e21d6aca29ccb6c455c88fcb42fbcd919d3198813e778a56fd19d791bf39fe
Instruction ID: 2f50c10564a5e8671197681c54a4b557aec15516def1c96b9c925cabb7f24a73
Opcode Fuzzy Hash: a8e21d6aca29ccb6c455c88fcb42fbcd919d3198813e778a56fd19d791bf39fe
Instruction Fuzzy Hash: 13C2A574E002288FCB64DF69C984B9DBBB5FB89300F1491E9D509AB365DB30AE85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02A129D8 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

\Vl, xrefs: 02A12EB8

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 0a908960b8ee325f862a6caed38d22b2d654c302b21ed7c35071439789cb96bc
Instruction ID: a0dab36373aaab3419d6cc3039133952db08d65b9b31c45e82cb2fccc65f477d
Opcode Fuzzy Hash: 0a908960b8ee325f862a6caed38d22b2d654c302b21ed7c35071439789cb96bc
Instruction Fuzzy Hash: 5F02D2B0D00229CFDB24CFA8C881B9DBBF1BF49314F1495AAD909B7250EB749A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 029FEF50 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 029FEFF2

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: d01fd45482c388586770f96fc3abaf4106641451b510e9f03b2cc54510273726
Instruction ID: da9cb3a4222eecb117d9d11504372e92561e52575b2285e06a39d690c9262afa
Opcode Fuzzy Hash: d01fd45482c388586770f96fc3abaf4106641451b510e9f03b2cc54510273726
Instruction Fuzzy Hash: 2041FFB5D04258DFCB10CFA9D484AEEFBF0AB49310F14942AE455B7250C778AA89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 029FEF58 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 029FEFF2

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 333abc6c5f667062aad69a18f08dd7a76bb5c557fac8cc2552d0041b1f98debc
Instruction ID: 247e7bead866db35368cf6b9d9a5ace2b007aaa25e30b5d1653cc0ee15247974
Opcode Fuzzy Hash: 333abc6c5f667062aad69a18f08dd7a76bb5c557fac8cc2552d0041b1f98debc
Instruction Fuzzy Hash: 3841EEB5D04258DFCB10CFA9D484AEEFBF4AB49310F14942AE455B7250C778AA89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0619D4B8 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 0619D5BD

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: d751e6819e11a6b4eda1acdda19c2e35cb6430460855cdda1bffddf1c84367c4
Instruction ID: e2311968d980ad8370f5b005c6bb549c69672b602b43e61207f3b85f12f9d55c
Opcode Fuzzy Hash: d751e6819e11a6b4eda1acdda19c2e35cb6430460855cdda1bffddf1c84367c4
Instruction Fuzzy Hash: 66D1A274E00218CFDB58DFA9D994A9DBBB2FF89304F1080A9D409AB365DB35AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02A1CE88 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

>E, xrefs: 02A1D066

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID: >E
API String ID: 0-232236476
Opcode ID: 114fbb0b6ea1b66e8771f6a8ad6ac6458330c27b1eebcd2cf646d6dc069bc07f
Instruction ID: d52fd8071cbf0e17a55d06132b67cdefe155d5550970ec4cf06b790583367490
Opcode Fuzzy Hash: 114fbb0b6ea1b66e8771f6a8ad6ac6458330c27b1eebcd2cf646d6dc069bc07f
Instruction Fuzzy Hash: 1AA1D374E44218CFDB14CFA9D884B9EBBF2FB49320F10916AD409AB2A5DB745D86CF05

Uniqueness

Uniqueness Score: -1.00%

Function 02A1CE7A Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

>E, xrefs: 02A1D066

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID: >E
API String ID: 0-232236476
Opcode ID: 908fa34850288d898d5c6029c4062b3da3a38322a066709818c2b4ab25db8696
Instruction ID: 84b793e4a5249b66482123ef8296ec7d744ca90365feece9f771853eb19a52b0
Opcode Fuzzy Hash: 908fa34850288d898d5c6029c4062b3da3a38322a066709818c2b4ab25db8696
Instruction Fuzzy Hash: 23A1E474E44218CFDB14CFA9D884B9EBBF2FB49320F10916AD409AB2A5DB745D86CF05

Uniqueness

Uniqueness Score: -1.00%

Function 02A13808 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b31aaaab2baef660d6c9d1fe97d862e34669ac71d43c998f8739cf6736e83d
Instruction ID: 6a12e3ee0eebfd3bcca8fe26c770170e0d33a4a6c432f59f611a721862c9810c
Opcode Fuzzy Hash: e4b31aaaab2baef660d6c9d1fe97d862e34669ac71d43c998f8739cf6736e83d
Instruction Fuzzy Hash: DAF1F0B0D002288FDF20CFA9C881B9DBBF1BF48314F1495AAD909B7250EB349A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 029FA006 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d328cd5d61c069e00e12380eb3c6a1e761207be69ccebf91ab993874e3f3ab
Instruction ID: c879bce4cd51a316c134cd75ab67da91c2a7fa28eb54e106d7e8cde780c9347c
Opcode Fuzzy Hash: 12d328cd5d61c069e00e12380eb3c6a1e761207be69ccebf91ab993874e3f3ab
Instruction Fuzzy Hash: 84E1E774A05229CFDBA4CF24D988BAAB7B5FB49304F1084EAD50EA7790DB745E85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 02A1E267 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ee2c7450580019f142df34cc8345e1b8adbe2877f99f732056ea486225e851
Instruction ID: 0cff3948e29be0451d707c0b39cabe67a831e69f3aead653df10bffb213e369b
Opcode Fuzzy Hash: 53ee2c7450580019f142df34cc8345e1b8adbe2877f99f732056ea486225e851
Instruction Fuzzy Hash: 43C147B4E04258CFDB14CFA9D994B9DBBF6FB49314F1080AAD809AB291DB345D82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 029F99BC Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d194f4c219c072dfa752a2507582667973e611f7ecc3806bc9625a3c18c46c02
Instruction ID: 604d5a6cb68995abe9f90859b2c4e779ae8beb1e311acd3348230eadc14a9ed6
Opcode Fuzzy Hash: d194f4c219c072dfa752a2507582667973e611f7ecc3806bc9625a3c18c46c02
Instruction Fuzzy Hash: FCD1F6B4944229CFEBA4CF14D998BEDB7B9FB49304F1090EAD50AA7291D7745E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A1F460 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46389331f5b6ddb68950559476ce9b71cb48092d97b45e80208bb26713a1f042
Instruction ID: a4b68dd125c2303e38c56fdef33ca47ecf3382b6bb5c32e8f5f7c097ff6b8016
Opcode Fuzzy Hash: 46389331f5b6ddb68950559476ce9b71cb48092d97b45e80208bb26713a1f042
Instruction Fuzzy Hash: 3DC1F3B4E01258CFDB54DF69D994BADBBB6FB89314F1090AAD409E72A4DB345D82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 02A1F470 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2cbef77156e12a5ff981e1531f2d1e930455b35e8df7be098234e351353996
Instruction ID: d1e78a69a76ac0b0b5d17f40d966f7d86aa1f35d215095f5b0e30361aac92160
Opcode Fuzzy Hash: 5a2cbef77156e12a5ff981e1531f2d1e930455b35e8df7be098234e351353996
Instruction Fuzzy Hash: ABC1F1B4E05248CFDB54CF69D994BADBBB6FB89314F1090AAD409E72A4DB345D82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 050626E8 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de481cd150b457cfe5b3b1eb6eb7409ac01af7073149d4d9c2e07d68f2bcd63
Instruction ID: 504caed72fbd72cd62d96e7a3e9a8e63bf263cdb6e408ed550483e0c13148eab
Opcode Fuzzy Hash: 1de481cd150b457cfe5b3b1eb6eb7409ac01af7073149d4d9c2e07d68f2bcd63
Instruction Fuzzy Hash: 2FC168B8D05229CFDBA4CF29D984BD9BBF5BB49300F1081EAD90DA7250EB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02A15A18 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef03abbec7a8176dac6fc2d8f2bc1d51bb9cc47309127ec14ece68b520efa0f9
Instruction ID: 9e355105f5f3c4be8c0024ae8abf88b63133d2efa13d0fe3145a5f88b95dfad5
Opcode Fuzzy Hash: ef03abbec7a8176dac6fc2d8f2bc1d51bb9cc47309127ec14ece68b520efa0f9
Instruction Fuzzy Hash: C3714AB0E45218CFDB14CFA9D888BAEB7F6FB89314F50506AD009AB295DB745D46CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A15A0B Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9953b5af850641ee220b27fb2a305d3d1822f872bf4ddec5772a75293f8c7be
Instruction ID: 76ca317c32ad851f94156ed6f3fe556b511381dcfed0de661c5eafca4ef1e34e
Opcode Fuzzy Hash: c9953b5af850641ee220b27fb2a305d3d1822f872bf4ddec5772a75293f8c7be
Instruction Fuzzy Hash: F8713AB0E45218CFDB14CFA8D488BAEB7F6FB89314F50506AD009AB295EB745D46CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A1D7C0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecaef137b9f0835183c991d9b2e4e8b3ccdc4b11a0bc4d9d54017c4fce1f25b6
Instruction ID: ec7405537e4ec9b44f6c55731a65385dd82ef4afc0e2b1359b3205986e948a25
Opcode Fuzzy Hash: ecaef137b9f0835183c991d9b2e4e8b3ccdc4b11a0bc4d9d54017c4fce1f25b6
Instruction Fuzzy Hash: 8D81E0B0D05608CFDB58CFAAD9847EDBBF6FB89710F10902AD409A72A5DB785946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A1D7B0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02aeab7981ffdfef27368444e59f731d072392821d652e8eef010e6e8be2dc6
Instruction ID: 2136b85edeaa2dcecce696e75ae7cee6051b1a2c285024b798bf221e08181ddb
Opcode Fuzzy Hash: c02aeab7981ffdfef27368444e59f731d072392821d652e8eef010e6e8be2dc6
Instruction Fuzzy Hash: 0681E1B0D05608CFDB58CFAAD9847EDBBF6FB89710F14902AD409A72A1DB785946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 029F8AB0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d634b6b4e8abd645501dbbd9d4f58432e09eb08bd3186a6ee9cd64cc2467496
Instruction ID: 2ac1ca84d87d28e7c8ad6850a45cf086aa58ce0b7490cdb8eb35972c02b38474
Opcode Fuzzy Hash: 8d634b6b4e8abd645501dbbd9d4f58432e09eb08bd3186a6ee9cd64cc2467496
Instruction Fuzzy Hash: 5C5100B0E06208CFDB94CFA9D5887AEBBF6FB49305F64502AD109AB290DB745D46CB00

Uniqueness

Uniqueness Score: -1.00%

Function 029F8AC0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614c308df113ec93dcdb3f5f3cb36f1ac13d1170fbf700b80baafe322533a9fc
Instruction ID: 4f73f71baa61ffba4037453653519e3d7046a1f257d967c41c98cb527cd9cec9
Opcode Fuzzy Hash: 614c308df113ec93dcdb3f5f3cb36f1ac13d1170fbf700b80baafe322533a9fc
Instruction Fuzzy Hash: 5E51F4B0A06208CFDBD4CFA9D5887EEBBF6FB49305F645029D109A7290D7745D46CB00

Uniqueness

Uniqueness Score: -1.00%

Function 02A14108 Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 02A14166
GetSystemMetrics.USER32(00000001), ref: 02A141A0

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: f9208bd4c43fbcca0c26c93e8e3035f679770afce19e35f5c95533a55240e5a0
Instruction ID: 57e1ed77462bf8fb98193aa19a954eb9bb8c5479a3ffb9c42881a21f3af693f7
Opcode Fuzzy Hash: f9208bd4c43fbcca0c26c93e8e3035f679770afce19e35f5c95533a55240e5a0
Instruction Fuzzy Hash: 2C2153B19003498FDB10DF99D4897EEBFF4EB58324F248429D159AB380D7B85989CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00EF09F5 Relevance: 2.6, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00EF0A77
Te^q, xrefs: 00EF0A8A

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 7cd4dd970be3191c12e97e759179072e18e6bca73f42ae9694801bc8c335625a
Instruction ID: 7fe8ff160a89d53190f833dbaf879f852e95e74c34973ffc2845f69ca07b9a71
Opcode Fuzzy Hash: 7cd4dd970be3191c12e97e759179072e18e6bca73f42ae9694801bc8c335625a
Instruction Fuzzy Hash: EA313E70E002088FCB08DFA9D5946BDBAF2AF88300F64546AE505F7365DE745D05CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0A32 Relevance: 2.6, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00EF0A77
Te^q, xrefs: 00EF0A8A

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: ed24bf007c5deb52cad74c8b0e775eb599749a5f24b8d0598d16fc00847af181
Instruction ID: 22bd8ca11ee6efac25ba2be18048f6e8b0f20dc7e192affce21ea79716c35376
Opcode Fuzzy Hash: ed24bf007c5deb52cad74c8b0e775eb599749a5f24b8d0598d16fc00847af181
Instruction Fuzzy Hash: D2215E30B002088FCB04EFA9D5957BDBAF2AF88700F641469E102FB3A6CE709D01CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05061A49 Relevance: 2.5, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 05061A79
4, xrefs: 05062248

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: #$4
API String ID: 0-353776824
Opcode ID: 78dacefed9efd70cd3c8e315b738424d5b9aa9072438d337e0c00850ae665a31
Instruction ID: 978f01dcda863e7c0cb01d30ee7b2deee6ab2586832ca40c1d9558c391da47f1
Opcode Fuzzy Hash: 78dacefed9efd70cd3c8e315b738424d5b9aa9072438d337e0c00850ae665a31
Instruction Fuzzy Hash: 5C11A2B49412A9CFDB64CF58DA95BEEBBF2BB04300F004499D209AB290DBB55E85CF05

Uniqueness

Uniqueness Score: -1.00%

Function 05061BF0 Relevance: 2.5, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 050618E6
@, xrefs: 05061C00

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: 1$@
API String ID: 0-1574762115
Opcode ID: c86e52cb40c95010bed628c2093278866b4c1f9448ad4467b2718041acb982e5
Instruction ID: 4d408e516831e9b43c611699604eac95b764299e72080afc2a632cbaaf36c8a3
Opcode Fuzzy Hash: c86e52cb40c95010bed628c2093278866b4c1f9448ad4467b2718041acb982e5
Instruction Fuzzy Hash: F901BDB4905299CFCB60CF14E988BEDB7B1FB09311F0484E6D90AAB250D7B49E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0506196C Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 0506199D
, xrefs: 050619C6

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: $D
API String ID: 0-1196817373
Opcode ID: 1f96712a7505b1754eee64f8d54e15d6a984be54e0829b7d5aae3de720c8bf54
Instruction ID: 274d3183d6ab6188d246eaa412c1d38115abc8fcb367651f073438d41c37bfeb
Opcode Fuzzy Hash: 1f96712a7505b1754eee64f8d54e15d6a984be54e0829b7d5aae3de720c8bf54
Instruction Fuzzy Hash: D6F0927484026ACFDB20CF14D988BEDBBF1BB18305F0084E6D509A6250D7B85EC5CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0CDD Relevance: 2.5, Strings: 2, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xT, xrefs: 00EF0CF1
8bq, xrefs: 00EF0CE5

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 8bq$xT
API String ID: 0-2801386707
Opcode ID: 4eae5520c06098fb462742874945456003dfc4220d8eaea5d7cd039eb98a1420
Instruction ID: 3d0e26ead92a1eaea17100cf0f6ce9a23102fce2cea8da14c816e64d56fc82ff
Opcode Fuzzy Hash: 4eae5520c06098fb462742874945456003dfc4220d8eaea5d7cd039eb98a1420
Instruction Fuzzy Hash: 47E0DF353400009FCB05EB38E98096877D2EB8D2503114468E28ACB3A4CA20DC468BC0

Uniqueness

Uniqueness Score: -1.00%

Function 050618F5 Relevance: 2.5, Strings: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 05061D7E
F, xrefs: 05061900

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: %$F
API String ID: 0-2945472538
Opcode ID: a911ec933f5fc36df03c42c0ee007fff86077ae9c7b175c76c1ca4c75d0ad7d3
Instruction ID: 882142435f62415ef89562142b051624a10aff0c928bc843d8640df312a03f31
Opcode Fuzzy Hash: a911ec933f5fc36df03c42c0ee007fff86077ae9c7b175c76c1ca4c75d0ad7d3
Instruction Fuzzy Hash: 15E0E574842228CFDF60CF60D948BEDBBF2AB05305F1051D9800DA32A1D7784A8ACF05

Uniqueness

Uniqueness Score: -1.00%

Function 0619E978 Relevance: 1.9, Strings: 1, Instructions: 677
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 0619ECF3

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 55bfc5b8ea48ca0d5b7b649610d539b4aeafc2cac7f08bb0c466df224941db2a
Instruction ID: d71ef95d422edfac8d9773bf8458ff7563b62d4d82d8687a04457ef8cb98b92b
Opcode Fuzzy Hash: 55bfc5b8ea48ca0d5b7b649610d539b4aeafc2cac7f08bb0c466df224941db2a
Instruction Fuzzy Hash: B8520875A002289FDB64CF69C981BEDBBF6BF88300F1545D9E509AB351DA309E81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 029FCB9E Relevance: 1.8, APIs: 1, Instructions: 263
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 029FCE0F

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ce4566d7e5503c6b763a90859c2fb53136aa9ab03f6565ac254c1b4d424cae98
Instruction ID: 10cb0380d3d9bc4b955610f4622b17060933d9ebfe104a2b72dc7a88319be063
Opcode Fuzzy Hash: ce4566d7e5503c6b763a90859c2fb53136aa9ab03f6565ac254c1b4d424cae98
Instruction Fuzzy Hash: A9A112B1D0021D8FDB90CFA8C8817EEBBB1BF09304F14956AE959B7290DB748985CF85

Uniqueness

Uniqueness Score: -1.00%

Function 029FCBA8 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 029FCE0F

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a738e05551e330681742e22de7c7c5f706a9f68827eb97e169e8185f4343f25d
Instruction ID: 5bcc4ff6928be396751cc93d4e5a38e445d68fe09c3636079980d491ea0c6b9e
Opcode Fuzzy Hash: a738e05551e330681742e22de7c7c5f706a9f68827eb97e169e8185f4343f25d
Instruction Fuzzy Hash: AFA112B1D0021D8FDB90CFA9C8817EEBBB1BF09304F14956AE959B7290DB748985CF85

Uniqueness

Uniqueness Score: -1.00%

Function 029FD850 Relevance: 1.6, APIs: 1, Instructions: 127injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 029FD968

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 298b0f7bd597e73b8be35a0dfe313bdce13571ac96b17595d1feeb5df4dc4002
Instruction ID: 0ddb6dc1f8965eadecf67ef230d7fb0420c1936dfc8d650f07a4bc3a22a1628b
Opcode Fuzzy Hash: 298b0f7bd597e73b8be35a0dfe313bdce13571ac96b17595d1feeb5df4dc4002
Instruction Fuzzy Hash: 7B4100B5D052089FCF40CFA8D840AEEBBF1EF4A314F14A02AE854B7250D735AA46CF64

Uniqueness

Uniqueness Score: -1.00%

Function 029FD890 Relevance: 1.6, APIs: 1, Instructions: 117injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 029FD968

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5c6b04bdb3b2eef48230007a0cb1bd5f39614fc8de2e4084a738c89b1fbbaf02
Instruction ID: c8cefca05c6b2d43fdd37094032d4cabb2cce3417611b394bd8e59170332fa18
Opcode Fuzzy Hash: 5c6b04bdb3b2eef48230007a0cb1bd5f39614fc8de2e4084a738c89b1fbbaf02
Instruction Fuzzy Hash: 1C41BAB5D012589FCF00CFA9D984ADEFBF1BF49314F24942AE819B7210D338AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 029FD898 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 029FD968

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0b1afe458f51e57f1e88e8046f85a8f065d4aeaff69d60dd09ac1ca535422fbf
Instruction ID: 918d54cfbb67af8b6f56dbfdff0def0332fb02cc6c809f295bbbc9bf32d9ce36
Opcode Fuzzy Hash: 0b1afe458f51e57f1e88e8046f85a8f065d4aeaff69d60dd09ac1ca535422fbf
Instruction Fuzzy Hash: 9F41CBB5D012589FCF00CFA9D984ADEFBF1BB49314F20942AE818B7210D338AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 029FD5D0 Relevance: 1.6, APIs: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 029FD682

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bf2be26771eccb1062c5e5b2b371e77489753a3e6f02ecd69d1cdce0d6117533
Instruction ID: 579e05fd515a0dc159b53f1e031c26fedcea9647139d76ec77df0c0c4080ecba
Opcode Fuzzy Hash: bf2be26771eccb1062c5e5b2b371e77489753a3e6f02ecd69d1cdce0d6117533
Instruction Fuzzy Hash: 0741B9B5D002589FCF10CFA9D980ADEBBB5FB4A310F10942AE919B7210D735A942CF68

Uniqueness

Uniqueness Score: -1.00%

Function 029FCF10 Relevance: 1.6, APIs: 1, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 029FD007

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fe08f8835b7b28b963ee002e87ec2a61cff3983f58b7df4e2b1ee3119e76f81f
Instruction ID: 7001f38a1edb5b9804f8abc4caf2e516806f8c1745915027823732f26fa66541
Opcode Fuzzy Hash: fe08f8835b7b28b963ee002e87ec2a61cff3983f58b7df4e2b1ee3119e76f81f
Instruction Fuzzy Hash: 53410FB5D012089FCB50CFA9D844BEEFBF0AF49314F24902AE408B7250D739A985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 029FD5D8 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 029FD682

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87f779b6b1ba433ff06f0c007da14a23d9d2ec55e49eca0f1ccf19b83d6f0489
Instruction ID: 57f0aacbbc17ea42168b662682c8f2c513ebc98d75ade51aeed472195c79d5b6
Opcode Fuzzy Hash: 87f779b6b1ba433ff06f0c007da14a23d9d2ec55e49eca0f1ccf19b83d6f0489
Instruction Fuzzy Hash: 6B31A8B8D00258DFCF10CFA9D980ADEFBB5BB49310F10942AE919B7210D735A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 029FCF52 Relevance: 1.6, APIs: 1, Instructions: 95threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 029FD007

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 50858a3c3a2edcf017d527f7561176e26b0f6099e304f56effba79128cecb589
Instruction ID: d9ed2059e0462bdb9f0145c584b5f818fa677f800b1c64f1f6fc99a487ceac67
Opcode Fuzzy Hash: 50858a3c3a2edcf017d527f7561176e26b0f6099e304f56effba79128cecb589
Instruction Fuzzy Hash: FC41DCB5D002589FCB50DFA9D884AEEFBF1BF49310F24842AE419B7240D779A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 029FCF58 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 029FD007

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fcd13502aa863f3a666f9206c93c8de09938f14e569ee264a72742c229a613fb
Instruction ID: dfb7f6bb3e4f76d2b68eaabcfcf27ddf420c34e0fa811daf195071793323b424
Opcode Fuzzy Hash: fcd13502aa863f3a666f9206c93c8de09938f14e569ee264a72742c229a613fb
Instruction Fuzzy Hash: 3231DCB4D002589FCB10DFA9D884AEEFBF0BB49310F24842AE418B7200D738A985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 029FDC2A Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 029FDCAE

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a51b9af03075c48f81956b43b92c1fb3f71fa8ac234656f46ba70e18092cb9b0
Instruction ID: 8806a46a343c568928fcc5c673870e62d426776daa4fcc2b3bead19d195bd55d
Opcode Fuzzy Hash: a51b9af03075c48f81956b43b92c1fb3f71fa8ac234656f46ba70e18092cb9b0
Instruction Fuzzy Hash: A531CCB4D002589FCB10DFA9D580AEEFBB5EF49310F10942AE919B7310C775A941CF68

Uniqueness

Uniqueness Score: -1.00%

Function 029FDC30 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 029FDCAE

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e2da916e6fe28455f365906d4e650efed06830e05a8ccb544e5b1bd4c4b64723
Instruction ID: b8ddf7ddc03fb1ec76e613f1487723e397fb632084193893c5465a72c30396ac
Opcode Fuzzy Hash: e2da916e6fe28455f365906d4e650efed06830e05a8ccb544e5b1bd4c4b64723
Instruction Fuzzy Hash: 1231CAB4D002589FCB10DFAAD980ADEFBB4AB49310F10942AE919B7310C774A941CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0897 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

HR, xrefs: 00EF08B1

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: HR
API String ID: 0-3147221351
Opcode ID: dac67767ff2b0a542c6b0196a58dd95dc596cff6cf48fd1d10d94bd0599df76a
Instruction ID: cbe87cc9192b9f24cd6fc639e5ea0bbabce844f34a8ff68e99c2dd4b741597e2
Opcode Fuzzy Hash: dac67767ff2b0a542c6b0196a58dd95dc596cff6cf48fd1d10d94bd0599df76a
Instruction Fuzzy Hash: 16414E74A0020A8FCB01DF69D9929AEFBF1FFC5300B10956AD515AB356E770AD06CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF08A8 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

HR, xrefs: 00EF08B1

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: HR
API String ID: 0-3147221351
Opcode ID: 2088b4a15d5539a489ca4f2f0f0ecfb12da898823bd610fa39933273072f8ef6
Instruction ID: 0a76a4ec5470332deb86518fc83be4aae2ce01c45ac89dd0e2d3229dbc3800cc
Opcode Fuzzy Hash: 2088b4a15d5539a489ca4f2f0f0ecfb12da898823bd610fa39933273072f8ef6
Instruction Fuzzy Hash: 7A310B74A0020A8FCB01DF69D992AAEFBF1FBC4300B009669D515AB345E771ED458BD0

Uniqueness

Uniqueness Score: -1.00%

Function 06185BC3 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

%, xrefs: 0618DB01

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 7565f6dd2bdb8c3f0ad7b7a25cc012732c9bd671840fff6520d9c61a67c300fe
Instruction ID: 484b443e1a6ad5d6e85261fb909425ed4a742f4824071038867e025228ff0ea9
Opcode Fuzzy Hash: 7565f6dd2bdb8c3f0ad7b7a25cc012732c9bd671840fff6520d9c61a67c300fe
Instruction Fuzzy Hash: D6116DB0A0521DCFDBA0DF64C888B9CB7B0EB49315F9050E5D119A3690CB309EC8CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0506163F Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4, xrefs: 05062248

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 4a0616b4d747b5c1032259405b7bc51833a7afa43f31c2c0b14f35423cee054f
Instruction ID: 5a2e5f438b182b6c66e7bb06f4ff65c6f578c76dbb1d2f42db16f07fbf571f90
Opcode Fuzzy Hash: 4a0616b4d747b5c1032259405b7bc51833a7afa43f31c2c0b14f35423cee054f
Instruction Fuzzy Hash: 4911C5B0D41259CFDB25CF58DA84BDEB7F2BB48300F008096D509A7290D3755D92CF00

Uniqueness

Uniqueness Score: -1.00%

Function 050620DF Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

H, xrefs: 050620ED

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: ddeae5fd68c65d6bcea0577ebd93697b466fa433a783911ef7f802eb434252b0
Instruction ID: 8a5dd2d24d38ae205330c2023e1e984de0257253760f2240e928b88bb3d22b96
Opcode Fuzzy Hash: ddeae5fd68c65d6bcea0577ebd93697b466fa433a783911ef7f802eb434252b0
Instruction Fuzzy Hash: C901A474840269CFDB60CF54D998BEDBBF2BB09301F0084D6D60AA6290D7B94AD5DF15

Uniqueness

Uniqueness Score: -1.00%

Function 050615BC Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

,, xrefs: 050615CA

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 438eeb0813e6029ab24f643b23cfc00a34fee7cf8b3d743613ea071157dc55fd
Instruction ID: 80ca5616c17dc0b1ed30bf2a5cb98f479ddf5170a46262f82a9a098af10e1310
Opcode Fuzzy Hash: 438eeb0813e6029ab24f643b23cfc00a34fee7cf8b3d743613ea071157dc55fd
Instruction Fuzzy Hash: 9001F670840269CFDB20CF94DA58BEDBBF2BB08301F0084D6D50AA6290C3B44ED5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05061760 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

4, xrefs: 05062248

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 83796a9f77e48261e137e9cb52d1b80ef7b33a1c23a32752f3934ddf7e7170ff
Instruction ID: d4de502c93d882df3762e5e8867e9dcb1284ebb66c674222c89c5e6b1c407491
Opcode Fuzzy Hash: 83796a9f77e48261e137e9cb52d1b80ef7b33a1c23a32752f3934ddf7e7170ff
Instruction Fuzzy Hash: FCF0A4B4941259DFDB11CF44EE94BDEBBF2BB09301F004495E60AAB290D7765E92CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05061E03 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

1, xrefs: 050618E6

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: c09623d2a6a69b23bfef4959aa28ad850ec95d5e0bc2da0dc9d52c933250ab77
Instruction ID: 2800411eaa14c2590188f760961c2b869ac79f8b3bfdc3b23de0de6afda231a7
Opcode Fuzzy Hash: c09623d2a6a69b23bfef4959aa28ad850ec95d5e0bc2da0dc9d52c933250ab77
Instruction Fuzzy Hash: 1BF0BC70D452688FCB64CF24D994BECBBB2BB48340F00959A840AA7261CB709E96CF05

Uniqueness

Uniqueness Score: -1.00%

Function 06186B5F Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

K, xrefs: 06186B85

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: a7c4f101602b065c3297a9f8295ea8bf9ae4d1678fb1545e400f7b64318d91ec
Instruction ID: 3e8b62cfbfee9e1a6c41524720ae09f65d49bb11564eff46adae35cca8ff10c6
Opcode Fuzzy Hash: a7c4f101602b065c3297a9f8295ea8bf9ae4d1678fb1545e400f7b64318d91ec
Instruction Fuzzy Hash: 9DF05E34E0412DCFDB65DF64C8547D973B0EB49316F1180E49219A7640CB744EC8CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0506189D Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

1, xrefs: 050618E6

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 7dee85e9c2259cc5c2f3614522766ad13f94db097535fa24c7e0d1c90210985c
Instruction ID: ef82c869bdcc0ea5bb1b40841580dfd5df8c5e244ed3a77ff12dd253f5b126c5
Opcode Fuzzy Hash: 7dee85e9c2259cc5c2f3614522766ad13f94db097535fa24c7e0d1c90210985c
Instruction Fuzzy Hash: 7FE0C274D012188FCB65DF20D894ADCBBF1FB88340F00959AD40AA7261CA309E96CF05

Uniqueness

Uniqueness Score: -1.00%

Function 050614A0 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

A, xrefs: 050614D7

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: e7316f559b0ef2479d85ae9b9d5c9b784e3e1676cd75d6ec2fc4129434fffd17
Instruction ID: c0c43715d325c3d7c4ba6e0c9201ba9b3eb76c1720dbfc2bddf8fa050a58550f
Opcode Fuzzy Hash: e7316f559b0ef2479d85ae9b9d5c9b784e3e1676cd75d6ec2fc4129434fffd17
Instruction Fuzzy Hash: 28E046B598431A8FDB20CF10CD04BEDBBB1FB00305F000195E609A6290C3B88A96CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0848 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

R, xrefs: 00EF0851

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-2121812343
Opcode ID: 257441ebba7e4077121d762309498d8e8717710be3fe71ab72862dd73c6c00d1
Instruction ID: eba8ab1de154904af5a02c0757e0ddedc8a4aea9c6511193ec05fa53dafe8e8a
Opcode Fuzzy Hash: 257441ebba7e4077121d762309498d8e8717710be3fe71ab72862dd73c6c00d1
Instruction Fuzzy Hash: 84D01231900208EF8F00DFA9E94155DB7F9DB89210B1045A8D408E7214DA716F049B90

Uniqueness

Uniqueness Score: -1.00%

Function 050626D8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0edd3b234fce501fdde72e5dac7481979757387f4c8a0ea4d55e8e7f80ee1a0
Instruction ID: 863b1fccf7c4f9ed5ab356818326dada1c966ee2ccd0767c24478eec7ada9a9a
Opcode Fuzzy Hash: a0edd3b234fce501fdde72e5dac7481979757387f4c8a0ea4d55e8e7f80ee1a0
Instruction Fuzzy Hash: 5AB179B8D05229CFDBA4CF29D984BD9BBF5BB49300F0081EAD90DA7250EB745A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05062789 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b3bc2591074073411c3cd1ca7979785e2ca0fcde61ab95e4c0410746e40d45
Instruction ID: d0ff3fa27904c5955a311ad26c15471907e346e465a915ad0146e1d6a16dcff9
Opcode Fuzzy Hash: 44b3bc2591074073411c3cd1ca7979785e2ca0fcde61ab95e4c0410746e40d45
Instruction Fuzzy Hash: B9B169B8D05229CFDBA5CF29C984BD9BBF1BB49300F1081EAD90DA7250EB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 050629AA Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6228d66470caeed543317064e5c972f554d6ea752cc8b3fa5fa886191994fb2c
Instruction ID: 5c445c3ae148566151e8ee9ead0cd9153c7dbedd781085d9d5f88ce59ca18121
Opcode Fuzzy Hash: 6228d66470caeed543317064e5c972f554d6ea752cc8b3fa5fa886191994fb2c
Instruction Fuzzy Hash: 90B159B8D05629CFDBA4CF29D984BD9BBF5BB49300F1081EAD50DA7250EB309A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05062CAD Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d9ce5c89ac070a9cc16a22a66b3f727cd1489e67de7316530467810d35bd23
Instruction ID: 4033aeb03ac0c2cec54b38985a78fcca706501c2c1696d12ac47a082360b8ba4
Opcode Fuzzy Hash: a2d9ce5c89ac070a9cc16a22a66b3f727cd1489e67de7316530467810d35bd23
Instruction Fuzzy Hash: F1B169B8D05229CFDBA4CF29D984BD9BBF5BB49300F1081EAD90DA7250EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05062A38 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94eb330cd3e37195bae4d2d3bdbefa2ba7086896cbdaaf2110675866450bb307
Instruction ID: e43992cc86c5334507a7ffb0492412fc216929a06e9af3ad5fe7f3cb57e639c8
Opcode Fuzzy Hash: 94eb330cd3e37195bae4d2d3bdbefa2ba7086896cbdaaf2110675866450bb307
Instruction Fuzzy Hash: 0EB15AB8D0562ACFDBA4CF29D984BD9B7F1BB49300F1081EAD90DA7250EB745A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05062C39 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e39ed7c57880553216a208bc929c32d8ba0ce067c2ec02cddd7ab87d185b12
Instruction ID: 2b19c76bba4f2ca8b43fe89b29dce57c73e376fdcb5d66ef834ff16cdec16817
Opcode Fuzzy Hash: f3e39ed7c57880553216a208bc929c32d8ba0ce067c2ec02cddd7ab87d185b12
Instruction Fuzzy Hash: F5B159B8D05229CFDBA4CF69D984BD9BBF5BB49300F1081EAD90DA7250EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05062B09 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615983c1aec4c57f552297acf2a8230b57fa58746e591a323458a2713d1e6774
Instruction ID: 79fb4fe875594646f18aa61b7081322ee9b2538880a3d6738c8d7e65797b6aae
Opcode Fuzzy Hash: 615983c1aec4c57f552297acf2a8230b57fa58746e591a323458a2713d1e6774
Instruction Fuzzy Hash: 77B159B8D05229CFDBA5CF29D984BD9BBF1BB49300F1081EAD90DA7251EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05062A8F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdee96f56c374e24f82419d91b94f58ded09e6355be68fd21779b9ead7bf6a6e
Instruction ID: 9e7f715d9b1fcb6482692dc5b12cb6f6fc90723950969f2eb7f88836b0d377a7
Opcode Fuzzy Hash: bdee96f56c374e24f82419d91b94f58ded09e6355be68fd21779b9ead7bf6a6e
Instruction Fuzzy Hash: 07B159B8D05229CFDBA5CF29D984BD9BBF1BB49300F1081EAD90DA7250EB745A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05062911 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38236eb5bb59c9528787abfbb8db5915ffac926f25f13ec2509ec5ad0fc3c819
Instruction ID: 5b7b6e80a8e1dd041f7bfe01798f7d94b093c5b3d87ea42c0773888b9ca3f7bc
Opcode Fuzzy Hash: 38236eb5bb59c9528787abfbb8db5915ffac926f25f13ec2509ec5ad0fc3c819
Instruction Fuzzy Hash: F8B168B8D05229CFDBA5CF29D984BD9BBF1BB49300F1081EAD90DA7250EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 050628AB Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52d3664aef4331f76a0bad61164d792d118fe01e6ff792177d3c3fbadff120c
Instruction ID: 807f621f86b4110885e0d9c22107995f3846ac95a4c905f91f9393c6d86721a1
Opcode Fuzzy Hash: b52d3664aef4331f76a0bad61164d792d118fe01e6ff792177d3c3fbadff120c
Instruction Fuzzy Hash: C3A15AB8D05229CFDBA5CF29D984BD9BBF5BB49300F1081EAD90DA7250EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05063C80 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f35f81aef198c805b2e65126b7bb88fd2232e24bc8e7bb20e73176d39e5c3f
Instruction ID: 1311bb247525aed698c0f64a2c6edc5441b17993d4fce989040ba4c134ce37d9
Opcode Fuzzy Hash: d2f35f81aef198c805b2e65126b7bb88fd2232e24bc8e7bb20e73176d39e5c3f
Instruction Fuzzy Hash: 0A81F374E00208CFDB44DFA8E4946EEBBF6FB89310F20952AD419AB394DB355946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05063C70 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a13112e008de25dada6457329dc57529fe161375e463237870600f31f53ec7
Instruction ID: 86022e5ccde4ab38e390ec9ecefaeff1c9f52989f6926b4db0020a512cfd0a46
Opcode Fuzzy Hash: f5a13112e008de25dada6457329dc57529fe161375e463237870600f31f53ec7
Instruction Fuzzy Hash: A88105B4E00208CFDB44DFA8D4956EEBBF6FB89310F24942AD419AB394DB345946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096369073.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5a5d02a8d72ee685a04472aec9ca9514f31ac075f932338c9a59dcd5eb0bd3
Instruction ID: 634cbfd01e93eb8f98ad9469a730c6ca3a8a0e8c091698ae7446d70bf97e2dec
Opcode Fuzzy Hash: 0f5a5d02a8d72ee685a04472aec9ca9514f31ac075f932338c9a59dcd5eb0bd3
Instruction Fuzzy Hash: 44212571108240DFCB11DF14DDC4B27BFA6FB89314F20C569E90A5F656C336E846C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EAD005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096369073.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e9a0814c14afc4639a524ce50584cd48ade662012212ee3c6be7e0019d8e5e
Instruction ID: 82f16d1490e34e5d4bbc20ff6dee54ee7658068bbdfb6f5df06859e9415d10fa
Opcode Fuzzy Hash: 08e9a0814c14afc4639a524ce50584cd48ade662012212ee3c6be7e0019d8e5e
Instruction Fuzzy Hash: 85217F755093C08FCB12CF24D9D4716BF72EB8A314F2981EAD8459F657C33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFC6F8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad945948f464cec44b264be3911332aa974e34cae1f7c613b99df7e7897a5cf
Instruction ID: 9eb4c0826388617f7385ac9b2cdd8543bef43809f05c49498104a9702a46e41b
Opcode Fuzzy Hash: cad945948f464cec44b264be3911332aa974e34cae1f7c613b99df7e7897a5cf
Instruction Fuzzy Hash: 7A21137094420CDFDB00EFB8C6492BDBBF5EB49304F34A0A6E509A7291EB745A85DF01

Uniqueness

Uniqueness Score: -1.00%

Function 0619D940 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc45e4595b7e15d9f14328cb15f189253db138b23c8d650fae3b644fb73a751
Instruction ID: 0ad0dcf139c0f3032dd6bc7199439b7a91a9562058d88a5d3b86c772afc60215
Opcode Fuzzy Hash: 0fc45e4595b7e15d9f14328cb15f189253db138b23c8d650fae3b644fb73a751
Instruction Fuzzy Hash: 5A11B3B0E002099FCB48DFB9C9456AEBBF5FF88300F20846A9418B7354DB319A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05062669 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b478c5e2df5c58d706821f08081b685c5aaafe4df064cffc7738673eb00be478
Instruction ID: 7419cb1f8dde938d861a0b9769e3d2d524c398daca4ee86d0ea4e6726ff29bc7
Opcode Fuzzy Hash: b478c5e2df5c58d706821f08081b685c5aaafe4df064cffc7738673eb00be478
Instruction Fuzzy Hash: C9014676C0020AEBCF019F98D841AEDBB71FF99320F048519E95877250D732A6A6DB90

Uniqueness

Uniqueness Score: -1.00%

Function 050614E6 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e004da100c3dfea855b049035c0bb6a3e9865112df52ed043bacd4eae72f781
Instruction ID: ef1b6138d787c1301ef2d896885d40f425fcaf3d090379faee5e5587d106c6ec
Opcode Fuzzy Hash: 7e004da100c3dfea855b049035c0bb6a3e9865112df52ed043bacd4eae72f781
Instruction Fuzzy Hash: B701D0709002A9CFDB64CF64D994BEDBBB2BB08300F0088DAD10AA6290CB755E95CF15

Uniqueness

Uniqueness Score: -1.00%

Function 05062678 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d75cb4cc69a48b898578d087ae1ca5041d4d53d6ea98cecfc5dd2736ad2737a
Instruction ID: 0209c007f4da31bad713ef451c893178b83ffabbc48bc94f3f162651b01009bc
Opcode Fuzzy Hash: 5d75cb4cc69a48b898578d087ae1ca5041d4d53d6ea98cecfc5dd2736ad2737a
Instruction Fuzzy Hash: 51F0C435D0060AEBCF01DF99D8009EEBB75FF89320F10C519E95837210DB72A6A6DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0619FF38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45078a1fdd54a97153d157ac7065bb47373298979198530e0cbe3aeb39f7a570
Instruction ID: 0e56d7100919995632c1a509381aa45f8881b4d06482d57f544d41568f517ba1
Opcode Fuzzy Hash: 45078a1fdd54a97153d157ac7065bb47373298979198530e0cbe3aeb39f7a570
Instruction Fuzzy Hash: FEF05E393406009FC718DB59D558D3A77AAFFC8721B10446DFA068B370CA71EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05061CCF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e604ac7e9f66f7defbb326fab97adc7d6d0f62190e5103b83226b1fe5c7c73ea
Instruction ID: e01fcb25412f22c01259034c0222b9c1a84cceaa87652020f074448c9675dacb
Opcode Fuzzy Hash: e604ac7e9f66f7defbb326fab97adc7d6d0f62190e5103b83226b1fe5c7c73ea
Instruction Fuzzy Hash: C801E478940268CFDB60CF44D984BEDB7B1FB08300F1480DAD509A7290D3759E82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05063910 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91664444461e8cd1858e9974b080bcfd073c06c7f426a6aa737b4841eeb8c5e
Instruction ID: b330f1ddbd4b329b39d305313704f842880d9175570668b161136f268fb1e251
Opcode Fuzzy Hash: e91664444461e8cd1858e9974b080bcfd073c06c7f426a6aa737b4841eeb8c5e
Instruction Fuzzy Hash: 88F03A75904108EFCF40CF94D841BEDBFB1EB49310F14D4A9E80563351C6328A56EF50

Uniqueness

Uniqueness Score: -1.00%

Function 05063968 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b43cafb66e02ae1ead5722b96077ff512f78bb8e91d0259946a04eeaa9f3b4
Instruction ID: 3ba3f68863c53eb9a4861894806232ca6b5cbd9dba4369762a32b6f348106690
Opcode Fuzzy Hash: a4b43cafb66e02ae1ead5722b96077ff512f78bb8e91d0259946a04eeaa9f3b4
Instruction Fuzzy Hash: 1CF03A76804108AFCB41CFA5D841AEDBFB1EB49310F18D5A9E84462291D6328A66EF50

Uniqueness

Uniqueness Score: -1.00%

Function 05060368 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e5d7e67cb71038b0572129a4b5a916e0b8a4c73ba507bea735d3e107a07a42
Instruction ID: 3862786584ba6bd424fd82dc9aa3fe2feea4cb5395a030853f367605924594b2
Opcode Fuzzy Hash: b3e5d7e67cb71038b0572129a4b5a916e0b8a4c73ba507bea735d3e107a07a42
Instruction Fuzzy Hash: 1DF08279809248EFCF12CFA0E8519DCBF75FF0A310F15908AEC4467262D7728A66EB11

Uniqueness

Uniqueness Score: -1.00%

Function 05063078 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6399a412f56ec5f7a67c9031cfdfc83d1a84d61ae9dffa7585dfc736b0f65209
Instruction ID: 758dd0969cccc72ae49d6118dc4e9a3c3605489f66799d8e00de6baf098297eb
Opcode Fuzzy Hash: 6399a412f56ec5f7a67c9031cfdfc83d1a84d61ae9dffa7585dfc736b0f65209
Instruction Fuzzy Hash: ACF08275C04108EFCF41CFA9E885AECBFB1EB59320F14C2A9E844A3751C6368A56DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0619DD08 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5004aa39d062a2daf0618e3c832f05164e68cb14eef6186e1a3cb9eb66f01c
Instruction ID: bd7b4069973d9147767928b4e7c47a70822f5e2eef7ab04fce5efb3f7ed8cad0
Opcode Fuzzy Hash: 2c5004aa39d062a2daf0618e3c832f05164e68cb14eef6186e1a3cb9eb66f01c
Instruction Fuzzy Hash: 97F0F874D04208EFCB84DFA9D840AADBBF8EB49210F14C49AA858E3341D6359A51DF50

Uniqueness

Uniqueness Score: -1.00%

Function 061831DC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024851e020f3d6666494d3b69e83d934528aa26e14c83dbd8f80fe1e6f61837e
Instruction ID: 26d2e1892d1e7a49ec5c62d77ed95a17dee7c7a8e9a4145ed163dda3336d54ab
Opcode Fuzzy Hash: 024851e020f3d6666494d3b69e83d934528aa26e14c83dbd8f80fe1e6f61837e
Instruction Fuzzy Hash: 5EF0B674A012188FEB68DF68D855E9977B1FB49304F2052A5E41DA7354CF30AD85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05063FA0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66358eeecfae6916c9538f6f9e42eff027aedc46eb834fe068a62499f73d8fd5
Instruction ID: e8e6ca23d0d01d4138cddd04babbce221522d5dcfe9d6748621b704959643455
Opcode Fuzzy Hash: 66358eeecfae6916c9538f6f9e42eff027aedc46eb834fe068a62499f73d8fd5
Instruction Fuzzy Hash: ABF03974E04208EFC784DFA8E84569EFBF4EB48304F14C4AAA818A3340D635AA45DF81

Uniqueness

Uniqueness Score: -1.00%

Function 050638C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618ac7c7847d333554a9fd5ea57053e10543a2311aa849c9556d027fd0d2882f
Instruction ID: e0b90431d9626985592d6316c9ed16a8a9766feb6efab2ec3fcde2b2726bd0b2
Opcode Fuzzy Hash: 618ac7c7847d333554a9fd5ea57053e10543a2311aa849c9556d027fd0d2882f
Instruction Fuzzy Hash: 33F0A0B5C08208AFCB40CBA4D8416ECBFB1EB59310F1480EAE88563341D6368A46EF40

Uniqueness

Uniqueness Score: -1.00%

Function 050630FF Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181d7af170cf5e24b9e66d080d69aa24e8e0ee7655a28b22bae6c2e1c781e9fd
Instruction ID: 06666a8b4a16397bafb5f4dec7b2fda35d2a78edfab8f9a9807a2c743256baa1
Opcode Fuzzy Hash: 181d7af170cf5e24b9e66d080d69aa24e8e0ee7655a28b22bae6c2e1c781e9fd
Instruction Fuzzy Hash: 94F01575904208EFCF45CF85E850AECBBB1FB48310F20C5AEE81467251C7328A55EB80

Uniqueness

Uniqueness Score: -1.00%

Function 05063920 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc12112fb0428c71fe4d0c237aad64c8cbe617b1012c15cdee1b6e27ad85490
Instruction ID: 9c391eef56bc3871b382ab6a935d2a98be0ff49f6e0e2dfc2256064f124cbff6
Opcode Fuzzy Hash: 0bc12112fb0428c71fe4d0c237aad64c8cbe617b1012c15cdee1b6e27ad85490
Instruction Fuzzy Hash: 30F01575904208FFCB40CF98E940AACBBB5FB48310F10C499EC0963350C7329A61EF90

Uniqueness

Uniqueness Score: -1.00%

Function 0506116A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db5e4dc81561696b1737eb900e72f31c093a4a9a487b5cdd101ec82a1dcb222
Instruction ID: f4c2abf22cab0b322dd47ab4ae45b76688f9a665f56e4029b0b4057ae84573c6
Opcode Fuzzy Hash: 1db5e4dc81561696b1737eb900e72f31c093a4a9a487b5cdd101ec82a1dcb222
Instruction Fuzzy Hash: A8F0A035209145EFCB56CF90D804AAD7F62EB0A310F188589EC141B2A2C6329952EB01

Uniqueness

Uniqueness Score: -1.00%

Function 05063978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9268a5c07821c4245a61216ab31c3822e8486701708c247a0324775355d7f36d
Instruction ID: 52fce880203e95378cf1b366bb5d6b51aabb5fc173310c7c9c4390aa6fa0c739
Opcode Fuzzy Hash: 9268a5c07821c4245a61216ab31c3822e8486701708c247a0324775355d7f36d
Instruction Fuzzy Hash: 9DF0153590420CEFCB41CF94E844AADBBB5EB49310F14C49AEC5867291C6329A61EF90

Uniqueness

Uniqueness Score: -1.00%

Function 05063AA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d62ef5eda3bd803bf2a550f13c029dc2ae93da8fd4252c5f6104f09cecf89b
Instruction ID: e1f67c956aa1c22cedca4e484664fda878cb7fc708da1ce059bcba69e998842f
Opcode Fuzzy Hash: 68d62ef5eda3bd803bf2a550f13c029dc2ae93da8fd4252c5f6104f09cecf89b
Instruction Fuzzy Hash: CCF0EDB5D04108EFCB44DFA8D4816ECBBB1EF59310F14D5AAD809A3341D6315A46DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05060378 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c96aba255500fc1a296ad361264653e960a5fa63cb45d79481d4818cb9f765d
Instruction ID: dbb4b1ba5e0d03424884b20be2c868472bde5cfb81588ae52127aa784532b869
Opcode Fuzzy Hash: 2c96aba255500fc1a296ad361264653e960a5fa63cb45d79481d4818cb9f765d
Instruction Fuzzy Hash: C0E06D35504108EFCB00CF94E9449ADBBB9FB49301F10C059FC0427251D7729A61EB40

Uniqueness

Uniqueness Score: -1.00%

Function 05061178 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c96aba255500fc1a296ad361264653e960a5fa63cb45d79481d4818cb9f765d
Instruction ID: f7e6650afafee5889e05ad60562f59c18e93c2bab891d5c605869c1009ed15f3
Opcode Fuzzy Hash: 2c96aba255500fc1a296ad361264653e960a5fa63cb45d79481d4818cb9f765d
Instruction Fuzzy Hash: 10E0ED35504108EFCB45DF94E9409ADBBB6FB49310F14D459FC1527251C7329A61EB51

Uniqueness

Uniqueness Score: -1.00%

Function 05063A50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04497bba6e6b7c74ccb5555e8f6f3af04a3624e10e2694e0b41c1e319c20fa82
Instruction ID: f1c536f9ec956ae994d526571a49f4c35c011bc6e17b7cb6f7a1dd6087e05557
Opcode Fuzzy Hash: 04497bba6e6b7c74ccb5555e8f6f3af04a3624e10e2694e0b41c1e319c20fa82
Instruction Fuzzy Hash: 30F0ED79D08108EFCB05CFA8E8506ECBFB1EB89300F14C0EAE84467341C6358A82EF80

Uniqueness

Uniqueness Score: -1.00%

Function 0619BE08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c199e9ccab92974b9bacf6a3eef140dd0e5821dc65c3a17e3b35f5fa82ef311
Instruction ID: dcc8eccc0a55e7ef709e8e95625926f0f0859f463ed95ed8c51bdf64e04d15e4
Opcode Fuzzy Hash: 8c199e9ccab92974b9bacf6a3eef140dd0e5821dc65c3a17e3b35f5fa82ef311
Instruction Fuzzy Hash: E3E0ED74E04208EFCB84DFA9D4406ADFBF4EB48310F10C4AAA808A3350D7319A51DF90

Uniqueness

Uniqueness Score: -1.00%

Function 06199090 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c199e9ccab92974b9bacf6a3eef140dd0e5821dc65c3a17e3b35f5fa82ef311
Instruction ID: 0d1e14e8bd9492a007e3d2b9dacb4335140a485f0c26de66ba20d79ac4b33a06
Opcode Fuzzy Hash: 8c199e9ccab92974b9bacf6a3eef140dd0e5821dc65c3a17e3b35f5fa82ef311
Instruction Fuzzy Hash: 32E0C974E05208EFCB94DFA8D44469CBBF4EB48310F14C5AAA818A3351D7359A51DF91

Uniqueness

Uniqueness Score: -1.00%

Function 06194DA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c199e9ccab92974b9bacf6a3eef140dd0e5821dc65c3a17e3b35f5fa82ef311
Instruction ID: db6eaa15df3f26b8a57abc407314d4ab67f28edd10951aaad507d6534b00075d
Opcode Fuzzy Hash: 8c199e9ccab92974b9bacf6a3eef140dd0e5821dc65c3a17e3b35f5fa82ef311
Instruction Fuzzy Hash: A2E0ED74E04208EFCB84DFA8D44069CFBF4EB49310F10C5AAA818A3350D7319A52DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05064128 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0b77d1e839bf894e5d211bc9d39b5c4f30e5077ac786c24216a5b036039f36
Instruction ID: 58e7a416318b81fe152cd2bbd3605304e6127f533d7eb4630013cc6f3d70462a
Opcode Fuzzy Hash: 5e0b77d1e839bf894e5d211bc9d39b5c4f30e5077ac786c24216a5b036039f36
Instruction Fuzzy Hash: D0E0DFBA6080409BC708C790D9852ACBBB29B66205F289498C8195B392C9329D43CA40

Uniqueness

Uniqueness Score: -1.00%

Function 05063C30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f28599b4bc20edc5c90cd69973f464971634362be857ba6c3c1a46d33885b4
Instruction ID: 1c8b92e83802ff3eb0152f8b8be32cb05a4af96193d0c5a5effd12fb1b0749d1
Opcode Fuzzy Hash: 96f28599b4bc20edc5c90cd69973f464971634362be857ba6c3c1a46d33885b4
Instruction Fuzzy Hash: E2E086B6908104DBC705C794D9457AC77B1DF56325F2494989C1957391D536AD43C680

Uniqueness

Uniqueness Score: -1.00%

Function 0619D460 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69614cab9a8ff18e5d7bba31106a556b5a18049ed5fba08cbc934c76cb798c4d
Instruction ID: c27c36d81b20faf709ffaa36c911be63ad1c36b9ed748e49350d19fd1ad75849
Opcode Fuzzy Hash: 69614cab9a8ff18e5d7bba31106a556b5a18049ed5fba08cbc934c76cb798c4d
Instruction Fuzzy Hash: 66E01230D052089FCB84DBF8A54666D7AF4DB49301F1051B5A404A3750DA301A50DB52

Uniqueness

Uniqueness Score: -1.00%

Function 05063A60 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1633130e126715274f966dc9884be8d1958774e376522a4aebae7dbc5f8a423d
Instruction ID: 1a54820f704765cf19f0ecd5ccb5d1d8cdfc9e19e90a55102c1a345c2686e609
Opcode Fuzzy Hash: 1633130e126715274f966dc9884be8d1958774e376522a4aebae7dbc5f8a423d
Instruction Fuzzy Hash: 63E01A78D08208EFCB44DFA8E480AACFBF5EB49310F10C4AAEC4463351C6319A51EF80

Uniqueness

Uniqueness Score: -1.00%

Function 050638D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1633130e126715274f966dc9884be8d1958774e376522a4aebae7dbc5f8a423d
Instruction ID: ed650a0da3be4a41b7e3ada8a8896471cf50ce627bfb8de27b6818e9c731241b
Opcode Fuzzy Hash: 1633130e126715274f966dc9884be8d1958774e376522a4aebae7dbc5f8a423d
Instruction Fuzzy Hash: 8BE01A74D08208EFCB44DF99E8409ECFBF5EB89310F10C4AAEC4463351C6369A55EB80

Uniqueness

Uniqueness Score: -1.00%

Function 0619E930 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22dd01491980dc3ed561e3c58b932a2eadf26c83236b1a3f1773de55f44497c2
Instruction ID: 121edbe65a4247b92e6214a3dd23433ac516dca0c63df2e60ccf249699cf7370
Opcode Fuzzy Hash: 22dd01491980dc3ed561e3c58b932a2eadf26c83236b1a3f1773de55f44497c2
Instruction Fuzzy Hash: 97E08674908118EFCB84DF94D841AADBFB8EF4A310F14D099E84867341D7319A41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05062004 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17bc0c760c5df62a2be79537d169427551a6906421c6c79623c5efdd823f392e
Instruction ID: 2a44b518d3b8ae853c8c2ea631b4d008b113bbf1cd240bdf33f2b4778787bd2a
Opcode Fuzzy Hash: 17bc0c760c5df62a2be79537d169427551a6906421c6c79623c5efdd823f392e
Instruction Fuzzy Hash: 39F0153190065EEBCF129F64C840ADAB732FF99300F109645E5193B260DB70ABAACF40

Uniqueness

Uniqueness Score: -1.00%

Function 05063AB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85612093bc73517d1da06b425439b944287ab4e16e903074dd4b85926b7d7989
Instruction ID: f91aa875801bd1475f31ee2cf484de00590b425879a5f43199b51c3e27633dc3
Opcode Fuzzy Hash: 85612093bc73517d1da06b425439b944287ab4e16e903074dd4b85926b7d7989
Instruction Fuzzy Hash: 83E04F34D04108EFC744DF98E4405ACFBF5EB48300F14D4A9D80863340C7316E41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 050646F1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe3efc102e04730dec30adfd294d209c01201df9852e14189fd4fd8c682e658
Instruction ID: 4e17e1b4dca487fd0690dbcf0c0dfdf3ef1774f8ff1d0789b9af847fa1c9c0f6
Opcode Fuzzy Hash: afe3efc102e04730dec30adfd294d209c01201df9852e14189fd4fd8c682e658
Instruction Fuzzy Hash: EFE012B6909004DBCB44CBD0EAC277C77A4EB56305F2AA49964096B390DA329D43D641

Uniqueness

Uniqueness Score: -1.00%

Function 061979D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57914e177bb5d398480a58dfa9576dc847c97607a5b7ec64b9043916a46bde2
Instruction ID: 86060b48bdd3b323e215aa1eea4484e27cc828d236b1c43b830b391b70b1e903
Opcode Fuzzy Hash: c57914e177bb5d398480a58dfa9576dc847c97607a5b7ec64b9043916a46bde2
Instruction Fuzzy Hash: E5E01A34D04108EFCB44DB99D4416ACBBB4EF49310F1084AA985863391D6316A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05064138 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea0ff07519fb4b62af36665a19f7c289eebecdc43183234c7b601478d43cd0d
Instruction ID: 0aad547795dd2269ff52c193315bcc3e96ba57d6bf5d0a5258d5a9f146423473
Opcode Fuzzy Hash: 7ea0ff07519fb4b62af36665a19f7c289eebecdc43183234c7b601478d43cd0d
Instruction Fuzzy Hash: 0EE01274A09108EFCB48DF94E9815ECBBB9EB85314F2491ADD81927351CA316E46DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05062BDD Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a18562732dc861b0c0505927669339ee5e4fc59c6f5fc0c95dbb94e34c278a8
Instruction ID: a16b23ede92b5639c473684df61779cec2701091a7fbd87b4cf71c39e1ff9622
Opcode Fuzzy Hash: 4a18562732dc861b0c0505927669339ee5e4fc59c6f5fc0c95dbb94e34c278a8
Instruction Fuzzy Hash: 93F09B789002288BCB60DF24C8607DDB7B2FB86300F5041EA8A0EB7650CB306E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05063C40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea0ff07519fb4b62af36665a19f7c289eebecdc43183234c7b601478d43cd0d
Instruction ID: e56d0995cbff10df26f61a99549e61aa7bd27215f4029c53887fd6b29842631e
Opcode Fuzzy Hash: 7ea0ff07519fb4b62af36665a19f7c289eebecdc43183234c7b601478d43cd0d
Instruction Fuzzy Hash: AFE0C234908208EFCB04DF94E8405ACBBB4EB8A320F209499E80823340CA316E52DB80

Uniqueness

Uniqueness Score: -1.00%

Function 05064A9A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad51457ce2a1f241ddeff8cf9fdaa81d423bb4efc6e310de766f3aa7a718c0f
Instruction ID: d1935e0edadbab0125ccd74e82cf69f95be54cbba545a0500551006b36ce163d
Opcode Fuzzy Hash: 7ad51457ce2a1f241ddeff8cf9fdaa81d423bb4efc6e310de766f3aa7a718c0f
Instruction Fuzzy Hash: F8D05BB154E044AEDB44C7E8A881BAD7FA4E706305F1465A9940663191D6700945D704

Uniqueness

Uniqueness Score: -1.00%

Function 0619C850 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ba944441a96cf00b06eb1898eff2d4165876c1991964bf3db91c14ebbc0a63
Instruction ID: d7d0724e28226b303e8f6e6609fa3ed64abbca736bc992efed0e94d0a83c379d
Opcode Fuzzy Hash: a8ba944441a96cf00b06eb1898eff2d4165876c1991964bf3db91c14ebbc0a63
Instruction Fuzzy Hash: 2CE0C234D08108EFCB48DFD4E9405ACBBB4EB45300F209099D80823341CB316E42EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05064700 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c444ddc071007ce67c1992392b8f01ad40534d4bddaa22e30fab11e99f04f04
Instruction ID: 3cca69d30f81ccf46718de19e0ab52460008d93ea8936cbf41ee09d37ec28434
Opcode Fuzzy Hash: 5c444ddc071007ce67c1992392b8f01ad40534d4bddaa22e30fab11e99f04f04
Instruction Fuzzy Hash: 67D0A734509108EFCB44CB94F980A6CB7FCEB47314F14909DA80963351DA32AE41D781

Uniqueness

Uniqueness Score: -1.00%

Function 05064AA8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad6b8e98995b95c04ccd798ef70006c1aae7200a9b568ac487cc70976f49ab8
Instruction ID: 5102f516ac863393eaaa72a7a30d41fd1a3b0021e21c7942eea2b1f23cf57889
Opcode Fuzzy Hash: 4ad6b8e98995b95c04ccd798ef70006c1aae7200a9b568ac487cc70976f49ab8
Instruction Fuzzy Hash: 60D0127058E108FFCB84DBE9F881BAD7BECE707215F106599A80923260DB711E80D759

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0C98 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38972dcc12716cdb36156104d7a622b7250cc3088cb226d412fb0e4709077558
Instruction ID: f79dc9e804b4e1d6f7f360978f8f7920a939b9aa0f6a5b2b9be67a167c37abc5
Opcode Fuzzy Hash: 38972dcc12716cdb36156104d7a622b7250cc3088cb226d412fb0e4709077558
Instruction Fuzzy Hash: 5BD0C7393405048FC744AF79E98492537E6FB4C6153514864E80DC7379EA31EC569B51

Uniqueness

Uniqueness Score: -1.00%

Function 05060776 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf335afc3036fadb24320133dc394c7accdad8478dc5a2ad5becf1a56a14eb34
Instruction ID: 8b0f136f7f90c1d8bd17596869a9be669112e0c8f39a631e1b9657b811d77589
Opcode Fuzzy Hash: cf335afc3036fadb24320133dc394c7accdad8478dc5a2ad5becf1a56a14eb34
Instruction Fuzzy Hash: 4BE0C779A00208EFCF028F80CC90BCE3B36EB4A310F008180A5892B2A4CB708ED2CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0619CC58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e580de407134e40ab59a9ea9ca84ed35a841e393c22db4bae999531ea81b33fb
Instruction ID: 8e615d111216ce9b63f53c9d3ba80eb13f78b432c197fb970145ded2afe1c44c
Opcode Fuzzy Hash: e580de407134e40ab59a9ea9ca84ed35a841e393c22db4bae999531ea81b33fb
Instruction Fuzzy Hash: 00C08C2004A60A8ECB84178466883703A9CA70BB03F003C04B00C100208BA22484C1A1

Uniqueness

Uniqueness Score: -1.00%

Function 05060ADC Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40540cf23019971b6cb721ba9f6266628adca0dea40d26a487cf566534df7381
Instruction ID: 6e0f5e6e66014597ce5aee5f713e6cca15130f126b35f13528c3a6daaeb22b3f
Opcode Fuzzy Hash: 40540cf23019971b6cb721ba9f6266628adca0dea40d26a487cf566534df7381
Instruction Fuzzy Hash: A4D092B5D04328CEEF109F22D8487DDBAB0AB16341F0041D9944562180C7780B84CF25

Uniqueness

Uniqueness Score: -1.00%

Function 0619FF10 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EFC7F8 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00EFC8AE
4'^q, xrefs: 00EFC8D9

Memory Dump Source

Source File: 00000000.00000002.2096641003.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 1f7808aa30261f51a864a6417db0793c6a7120b652c30a074bb17f2ed89ff56d
Instruction ID: 9e61825db0b27c0528c872691a3e6ae0bd9f649abbcfb7f6c3c25a1d9f030673
Opcode Fuzzy Hash: 1f7808aa30261f51a864a6417db0793c6a7120b652c30a074bb17f2ed89ff56d
Instruction Fuzzy Hash: CB61DCB0D002098FDB48DF7AE95169EBBF6EBC9300F14C52AD005AB275EB74694ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 029F5258 Relevance: 1.8, Strings: 1, Instructions: 556COMMON

Download Yara Rule

Strings

(bq, xrefs: 029F5328

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 5ba3ee7b0c282196a302c3538ad1317d0768e2a93ccd604ea8357b449c3f22df
Instruction ID: f517384feb39381137d9aa6cc65082923bc80471c6dc1f181c63aa49f04439f1
Opcode Fuzzy Hash: 5ba3ee7b0c282196a302c3538ad1317d0768e2a93ccd604ea8357b449c3f22df
Instruction Fuzzy Hash: 7A225870B006168FCB99CF69C49967EFBF2FB88310F648929D55AD7381DB30A951CB84

Uniqueness

Uniqueness Score: -1.00%

Function 02A12488 Relevance: 1.6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

Strings

\Vl, xrefs: 02A12895

Memory Dump Source

Source File: 00000000.00000002.2097707744.0000000002A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a10000_payment_invoice.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: dbddf9e90149081a3562b8b27946e45b6975a3f59435f95f2eca028bbe465980
Instruction ID: 5f032bbcac287ba8ca0984695640f5e11fd19951aa0b10be57f770f1b129ba0f
Opcode Fuzzy Hash: dbddf9e90149081a3562b8b27946e45b6975a3f59435f95f2eca028bbe465980
Instruction Fuzzy Hash: 8DE1E1B0D00228CFEB20DFA9C890B9DBBF1BF49314F1491AAD819B7254EB749985CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05064728 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

4:B, xrefs: 05064932

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4:B
API String ID: 0-2973858140
Opcode ID: e9370f27005904c6e68073e1e9dd8b91bc83b988219845d423cddbc34b342b20
Instruction ID: 39d79c70a04fcf59c19acadad232c1879a6bf6235e3fe5791e5715ffb5b8ee25
Opcode Fuzzy Hash: e9370f27005904c6e68073e1e9dd8b91bc83b988219845d423cddbc34b342b20
Instruction Fuzzy Hash: A38125B4D05208CFCB54DFA8E598BAEBBF6FB4A300F105129D40AAB294DB785D46CF45

Uniqueness

Uniqueness Score: -1.00%

Function 05064738 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

4:B, xrefs: 05064932

Memory Dump Source

Source File: 00000000.00000002.2110870571.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4:B
API String ID: 0-2973858140
Opcode ID: 197f16251c07d2dac3791acaad2aae6349a4f10a83a466f10381e7346f878640
Instruction ID: 014b339bef0e1c0ab2be120e5cf7366c2ca98d602931fac88492ff94bf64ca14
Opcode Fuzzy Hash: 197f16251c07d2dac3791acaad2aae6349a4f10a83a466f10381e7346f878640
Instruction Fuzzy Hash: 4C812374E05208CFCB54DFA8E598BAEBBF6FB4A301F105129D40AAB290DB785D46CF45

Uniqueness

Uniqueness Score: -1.00%

Function 029F7FB0 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

dbq, xrefs: 029F8151

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 20daa5d84b8e25e175dfa6ac18cfde6b03175d80c8b877a589a7d1b61817b8b8
Instruction ID: d21b5556b54267c8f9d55699a129ebf3eab0fed9eaf564708e3ce7fb63dd9182
Opcode Fuzzy Hash: 20daa5d84b8e25e175dfa6ac18cfde6b03175d80c8b877a589a7d1b61817b8b8
Instruction Fuzzy Hash: 5D913274D01208CFDB90CFA8D988BEDBBB6FB49304F545169D108AB2A4DB746E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 029F7FC0 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

dbq, xrefs: 029F8151

Memory Dump Source

Source File: 00000000.00000002.2097514456.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29f0000_payment_invoice.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 13cca790ea28d3386b2cf02e6ade21f4ca4ff4ddd1a343c8f55aa2f6da319649
Instruction ID: fab2dd5100cfc94cf3e991364b59f59f936e7db7d34eb37c34394e13725b58a9
Opcode Fuzzy Hash: 13cca790ea28d3386b2cf02e6ade21f4ca4ff4ddd1a343c8f55aa2f6da319649
Instruction Fuzzy Hash: DD913074D05208CFDB90CFA8D988BEDBBB6FB49304F505169D108AB2A4DB746E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0619C890 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56fcfc9029d4eab56b912b764b05c2caa3895aca7163d354ddc9b4f01af7efee
Instruction ID: 24fd154c0cd28686fbf9aa6660a089530b573a2331869e94b7348de89c4e068a
Opcode Fuzzy Hash: 56fcfc9029d4eab56b912b764b05c2caa3895aca7163d354ddc9b4f01af7efee
Instruction Fuzzy Hash: 19811774E05218CFEFA8DFA5C844BADBBF1BF49304F1194A9D049A7250DB705985DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06180040 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116568697.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6180000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962e5724cb1dbb64b227ce6d644bad686483189097835c7789f19bf37015e6a1
Instruction ID: 46836490f6607963787d5650a1ab66ef8dd9d5844e453ee493e6710cd20149b2
Opcode Fuzzy Hash: 962e5724cb1dbb64b227ce6d644bad686483189097835c7789f19bf37015e6a1
Instruction Fuzzy Hash: FD312D71E096199FEB68DF6AC848699BBF7BF89300F04C1AAD40DA6214DB344A85CF01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: payment_invoice.exePID: 2516, Parent PID: 6532COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.3%
Total number of Nodes:	48
Total number of Limit Nodes:	2

Executed Functions

Function 071DCBF8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 071DCD4D

Strings

LR^q, xrefs: 071DCC9E

Memory Dump Source

Source File: 00000004.00000002.2618281087.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71d0000_payment_invoice.jbxd

Similarity

API ID: InitializeThunk
String ID: LR^q
API String ID: 2994545307-2625958711
Opcode ID: b629bd3164fbf393011bfeb72300dd5f0bbffce547ea894ad53cb545b2047e83
Instruction ID: 44b146eedf3a5d643f70ec6790e9d9cab5ac2586dd3a98315ce09d7da40163ee
Opcode Fuzzy Hash: b629bd3164fbf393011bfeb72300dd5f0bbffce547ea894ad53cb545b2047e83
Instruction Fuzzy Hash: 67516E71B202158FDB09AFB5C46866E76F2AB8D600F114868D006EB3E4DF759D42CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 055E5A78 Relevance: 1.8, Strings: 1, Instructions: 553COMMON

Download Yara Rule

Strings

(bq, xrefs: 055E5B48

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 4a987133bf6ab423023495f471dd7acd0650dc49005ba3f227a01be7e8f26a5e
Instruction ID: 24bbfc05852359cc511f9c80304e6540d5f11e7b3a23586cdbd4bca9dd1264fd
Opcode Fuzzy Hash: 4a987133bf6ab423023495f471dd7acd0650dc49005ba3f227a01be7e8f26a5e
Instruction Fuzzy Hash: D3226970B006158FCB19DF69C495A6EFBF2FF88305F248929E55AD7381DB34A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DEB040 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 05DEB28B

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 35978d8130089b1f585fc29a5a988a8b9d0f485665d810ef859d70688682cba7
Instruction ID: dd30d3eb80ae8a20a834b7fb78cd3fcc2fc68561589bbb1715ae263032781e0e
Opcode Fuzzy Hash: 35978d8130089b1f585fc29a5a988a8b9d0f485665d810ef859d70688682cba7
Instruction Fuzzy Hash: D5918170E00209DFEF10DFA9C9857EDBBF2BF48314F14812AE455A7294EB74A885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05D90869 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f536dd64735be209d956ddad59966018e5f41d6a35ad00a2c21007b4f30f9684
Instruction ID: bda586a7a25f6a725cb3ad2710dc3a9b72e3d0afea7ecef3a38aa95002ea6532
Opcode Fuzzy Hash: f536dd64735be209d956ddad59966018e5f41d6a35ad00a2c21007b4f30f9684
Instruction Fuzzy Hash: BCE13E34640215CFCB18DF68D988A69B7F2FF88300F1585A9E90AAB361DB31ED85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 055EB138 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20268b4c50a1190f1b1c7819c5598bde3eced1bb5a4b6f1ffbe3f5c741a1c2b9
Instruction ID: c7b39f4e4dfcdba0512e57add0fcccb2f9bd6e597e65e6b508d44f036685a7ce
Opcode Fuzzy Hash: 20268b4c50a1190f1b1c7819c5598bde3eced1bb5a4b6f1ffbe3f5c741a1c2b9
Instruction Fuzzy Hash: 7EC12770A05209CFE70CCF59D988BAAB7B3FB88321F608169E4059B359D774ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DEBC58 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011f79b3c29d40d4281775c6d560e5e60450d6e9e6595b6ac1c4742940d4746f
Instruction ID: 08a026af0c0b97a3f4aefb2bb1ef41e3fd43d238c7b5111ebc1c15a5fe940f4a
Opcode Fuzzy Hash: 011f79b3c29d40d4281775c6d560e5e60450d6e9e6595b6ac1c4742940d4746f
Instruction Fuzzy Hash: 5CB14C70E04209DFEB10DFA8D8857ADBBF2FF88714F14812AD455A7394EB75A845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 057FB6A8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d968b928b906ce1a2c7df61d1aad430ce5ab45564195cc1f668b402f9fcaa26b
Instruction ID: f0108f5d5e85d6483165a72627639295ed471a91e907f8f8ca80a16f9fc34489
Opcode Fuzzy Hash: d968b928b906ce1a2c7df61d1aad430ce5ab45564195cc1f668b402f9fcaa26b
Instruction Fuzzy Hash: 7C919D70A08204CFEB04CF65E489BA97BF3FB88311F14C165D60AA7398DB759D85EB90

Uniqueness

Uniqueness Score: -1.00%

Function 057F61B0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8e6ad503a7c5b7b2b74d82f385cd45e102d56c576d31c488b6ab084ae541c8
Instruction ID: 80b0a66534ff3204de1a712150e99d6dd4217876154b31b1da0d7c997ca4a8ab
Opcode Fuzzy Hash: 6f8e6ad503a7c5b7b2b74d82f385cd45e102d56c576d31c488b6ab084ae541c8
Instruction Fuzzy Hash: A4815B74A14208CFCB08DFA9D855BADBBF2FB48304F508069E606EB3A5DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6CA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295f78e924f34bea92f21ad85609faf492d77a6bc4da39f4054eb1470af7d009
Instruction ID: 050d079786cbcef4cad3514d4179f1f65f1af0c420e8a47a31c4db3cb9146758
Opcode Fuzzy Hash: 295f78e924f34bea92f21ad85609faf492d77a6bc4da39f4054eb1470af7d009
Instruction Fuzzy Hash: EB516E34A04228CFCB44EF58ED48AADBBF2FB68314F558126D446AB3A1D734D941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 055E8BB8 Relevance: 5.3, Strings: 4, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 055E8C67
Hbq, xrefs: 055E8C93
(bq, xrefs: 055E8EA0
(bq, xrefs: 055E8D9B

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$Hbq
API String ID: 0-2483291755
Opcode ID: 04e0668143ac9f20a341b256cf5a9bc808fe1cd5f7f833bc07692a33aea381a6
Instruction ID: d6e96cdfa915a05c110b07ce11231c5e4e4fa6a5edda7ca7a9421bfacf5a3d64
Opcode Fuzzy Hash: 04e0668143ac9f20a341b256cf5a9bc808fe1cd5f7f833bc07692a33aea381a6
Instruction Fuzzy Hash: 3E9123313042948FC71AAB3898506AE7BF6FFC5710B14896AE50ADB3D2DE34DC06C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 055E13B0 Relevance: 4.1, Strings: 3, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 055E1515
(bq, xrefs: 055E14E9
Hbq, xrefs: 055E1541

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq$(bq$Hbq
API String ID: 0-2835675688
Opcode ID: c94620eef94c61536af7b688f8046950dc869bc7b5255952b70fb7af6443a5ee
Instruction ID: 461fb1d3a4f1c1afa4691adf31b2838e59bc5f6bf05fb24cfb9ec3b9e2a2cf73
Opcode Fuzzy Hash: c94620eef94c61536af7b688f8046950dc869bc7b5255952b70fb7af6443a5ee
Instruction Fuzzy Hash: 6CE10134B00619DFCB08EFA4D59499EBBB2FF89310F108569E406AB3A5DB30ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 055EDDC8 Relevance: 3.8, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 055EDE7C
4'^q, xrefs: 055EDEA1
fcq, xrefs: 055EDE2A

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: fcq$ fcq$4'^q
API String ID: 0-259698777
Opcode ID: b4cd06e70353425879bfd63038d539816524094345feaa11ef0a4c32e4066aee
Instruction ID: 9cd5baf792993e13e030e6f95a5a008ef80bd610c5d338a74033a674a0708712
Opcode Fuzzy Hash: b4cd06e70353425879bfd63038d539816524094345feaa11ef0a4c32e4066aee
Instruction Fuzzy Hash: 08219570D0020EEFCB08EFA8E5555AEBBB2FF95301F004969D40567290EF355E45CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 055EDDD8 Relevance: 3.8, Strings: 3, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 055EDE7C
4'^q, xrefs: 055EDEA1
fcq, xrefs: 055EDE2A

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: fcq$ fcq$4'^q
API String ID: 0-259698777
Opcode ID: e9cabde35aacadd03fdee4491ab26181c8ba7690070de53d82f7eefe43afa996
Instruction ID: 3e5d6034d3bb2a4e3cbbab7b340ea5012a832dc4eb4d26805f968cb231c34e95
Opcode Fuzzy Hash: e9cabde35aacadd03fdee4491ab26181c8ba7690070de53d82f7eefe43afa996
Instruction Fuzzy Hash: 9D215630D0020EEFCB08EFA8D5559AEBBB2FF94301F504929D41567294EF355E45CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 051B1468 Relevance: 3.7, Strings: 2, Instructions: 1245COMMON

Download Yara Rule

Strings

4'^q, xrefs: 051B241D
4'^q, xrefs: 051B2429

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: da5149a31f464888fceb16805fea4318c317824a8d4c020159d9d19ac9d13b19
Instruction ID: 7b08fbc915ec8d7836238f6638dfe43b3e7d0ef4e3a47729c56566ecd523a3cc
Opcode Fuzzy Hash: da5149a31f464888fceb16805fea4318c317824a8d4c020159d9d19ac9d13b19
Instruction Fuzzy Hash: E7823B34F40210AFAB382A7955A42BE65F7BBC8640F52452EDA03E7394DFB5CC85C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 053EFE08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 053EFE9B

Strings

4'^q, xrefs: 053EFE54

Memory Dump Source

Source File: 00000004.00000002.2596013730.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_53e0000_payment_invoice.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'^q
API String ID: 2492992576-1614139903
Opcode ID: 437f18fa092a5ec2b00a7d8af5cd8955e79332e2411c075d2545c76a0885759e
Instruction ID: 0dda46f169da920784e2b9da31fcf9d8ad1ed7175ace11cb95ac0651b477f1d1
Opcode Fuzzy Hash: 437f18fa092a5ec2b00a7d8af5cd8955e79332e2411c075d2545c76a0885759e
Instruction Fuzzy Hash: A62189709043598FCB10DFA9D9456DEBFF4EB48320F10849AE459A7381D7386984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053EFE18 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 053EFE9B

Strings

4'^q, xrefs: 053EFE54

Memory Dump Source

Source File: 00000004.00000002.2596013730.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_53e0000_payment_invoice.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'^q
API String ID: 2492992576-1614139903
Opcode ID: 0cb35dd02f113d0218d2f92767f93b97c44d4c17018ed5c136893d2bc0ad5fa4
Instruction ID: ddf3ad5eb0a9a986c52ae31fbd880c7f40b940b889bff3569dff060bf1c6cabe
Opcode Fuzzy Hash: 0cb35dd02f113d0218d2f92767f93b97c44d4c17018ed5c136893d2bc0ad5fa4
Instruction Fuzzy Hash: 852135B0D002198FCB10DFA9D9456EEBBF8FB48320F10845AE419B7381D7746944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D90040 Relevance: 3.0, Strings: 2, Instructions: 541
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 05D90435
$^q, xrefs: 05D90264

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID: 2$$^q
API String ID: 0-1071376767
Opcode ID: 45c7c51c6f40f9ae256592a5fb959389b21237c34bbf93c6f8b3b0c6306e2e8e
Instruction ID: f15159d29ef423f84878165a617bc7425e38972183243bd8c692cf957ca8ee32
Opcode Fuzzy Hash: 45c7c51c6f40f9ae256592a5fb959389b21237c34bbf93c6f8b3b0c6306e2e8e
Instruction Fuzzy Hash: F6322F74A00605CFCB28DF69E998A6DBBF2FF88304F1085AAD4099B355DB319D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 055E31B0 Relevance: 2.8, Strings: 2, Instructions: 289COMMON

Download Yara Rule

Strings

4'^q, xrefs: 055E3490
4'^q, xrefs: 055E3462

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: c01c2e30a6b17335c7b2ca8d8f8bd95f9caaa476e78212dd026ab6ef9940965b
Instruction ID: 8ad5d513f0841e54bd1df4dc33c01ea9e5c3ba70e060e3cb2f9461d78fa71daf
Opcode Fuzzy Hash: c01c2e30a6b17335c7b2ca8d8f8bd95f9caaa476e78212dd026ab6ef9940965b
Instruction Fuzzy Hash: 17C1A774B00218DFDB04EFA4C998A9EB7F6BF89300F114569E506AB3A5DB71ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 051B2460 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

4'^q, xrefs: 051B27F1
4'^q, xrefs: 051B27FD

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 5c8395dcaa16195811b2b246e8d141449ba396af01590478b0fb600c0c170287
Instruction ID: f93d24cf5bd484810bf252f9f814833b2afaa2a32ec431a9a1f1444bf75f6259
Opcode Fuzzy Hash: 5c8395dcaa16195811b2b246e8d141449ba396af01590478b0fb600c0c170287
Instruction Fuzzy Hash: DA919C38B201208B6B693A28507D17D39A7EBCC6613544519FD13E73C5DFB88D8B8796

Uniqueness

Uniqueness Score: -1.00%

Function 055E9200 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

(bq, xrefs: 055E9328
(bq, xrefs: 055E9500

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 6246f737dfbbeec7f933b0b3897c9e6491af96a3338eb986ed2d7e03f74476b3
Instruction ID: 19f897ceac60c2883b915dc558cdc020906e15fc01d4e7180ce975f2056a7e3c
Opcode Fuzzy Hash: 6246f737dfbbeec7f933b0b3897c9e6491af96a3338eb986ed2d7e03f74476b3
Instruction Fuzzy Hash: F0611031B006549FC718DF29C458AABBBF6FF98700B148928E04ACB781DE30EC02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 055E2873 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

Hbq, xrefs: 055E2A3D
(bq, xrefs: 055E2A11

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 6a2fb52564471936cb4d571f08566473631f513b25739b2b7119876ceca6149c
Instruction ID: 76e1beb0b1189698595dc12f207cf93193d51bb13ab342a99d001ebfaea402f6
Opcode Fuzzy Hash: 6a2fb52564471936cb4d571f08566473631f513b25739b2b7119876ceca6149c
Instruction Fuzzy Hash: 6761BF347086958FDB289F39C8146AE7BEABF80300F148569E446CB395DE34DD45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 055E26E0 Relevance: 2.7, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

(bq, xrefs: 055E2747
,bq, xrefs: 055E26F0

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq$,bq
API String ID: 0-1616511919
Opcode ID: 8a3bcbd0efd3c2e2a36059e2e5bff501965f74c4d53a06dc6351e4db89d7cc39
Instruction ID: f6799490ed129d2adaa4df1f9448a43cdd4310cdcccdfe9131bd29c2fa9bb636
Opcode Fuzzy Hash: 8a3bcbd0efd3c2e2a36059e2e5bff501965f74c4d53a06dc6351e4db89d7cc39
Instruction Fuzzy Hash: 9141A3337041596FCF129EA99C509FF7FEEEB89210F044066FA45E3291DA25CD259BB0

Uniqueness

Uniqueness Score: -1.00%

Function 051B37F0 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

4'^q, xrefs: 051B3937
4'^q, xrefs: 051B3943

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: b2fdc133f62fdca811f4bc76d80872f564a9a175febeeb912b292e6cd0e8525e
Instruction ID: 1369374ff0737394d370dae358c382f4f60af650293d03a40005e6e40c3885f9
Opcode Fuzzy Hash: b2fdc133f62fdca811f4bc76d80872f564a9a175febeeb912b292e6cd0e8525e
Instruction Fuzzy Hash: B931AE21F18122176F3D367821681BE15A7AFD8AA07154D2ED817DF388EFA4CC1253E3

Uniqueness

Uniqueness Score: -1.00%

Function 051B67D8 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

4'^q, xrefs: 051B692C
4'^q, xrefs: 051B6920

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 9d26f1d089fb503517f38bdfcbfde4698d6ceac7f5010a74c6716974f08ca858
Instruction ID: d1412a291b517147a61559397ed9a8263a4e9b575414e42123309aeb8237e677
Opcode Fuzzy Hash: 9d26f1d089fb503517f38bdfcbfde4698d6ceac7f5010a74c6716974f08ca858
Instruction Fuzzy Hash: 12310631F003114BEF3DA66965546BE62A7BFE0610B05402AD84ADF384EFF1CC4283B2

Uniqueness

Uniqueness Score: -1.00%

Function 071D1AD8 Relevance: 1.7, APIs: 1, Instructions: 176libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 071D1B38

Memory Dump Source

Source File: 00000004.00000002.2618281087.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71d0000_payment_invoice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 53f664f1f910b69638858ed05adba85fdb66199b08e407b4c9a8e0d1b4d843b7
Instruction ID: 763fd49663e47b42fca5ae60e5c23fbf2b097551695c9c4434b21fdbf3a37213
Opcode Fuzzy Hash: 53f664f1f910b69638858ed05adba85fdb66199b08e407b4c9a8e0d1b4d843b7
Instruction Fuzzy Hash: 84711E70A1030A9FCB14DF64E554BAEBBB2FF88311F109628D506A7294DB75AD4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 071D1AE8 Relevance: 1.7, APIs: 1, Instructions: 168libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 071D1B38

Memory Dump Source

Source File: 00000004.00000002.2618281087.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71d0000_payment_invoice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bf7c852af7014b7be894c940c4927fdc33f2f7348308d577b1aa74e8cef448c2
Instruction ID: ab19c2d4f72c165d1a06c262c01c22f94323871a11faec6c37b86bb3863a91ed
Opcode Fuzzy Hash: bf7c852af7014b7be894c940c4927fdc33f2f7348308d577b1aa74e8cef448c2
Instruction Fuzzy Hash: 09611D70A1030A9FCB14DF64D554BAEBBB2FF88311F109628D506A7394DB75AD4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F09280 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00F092F4

Memory Dump Source

Source File: 00000004.00000002.2502643110.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f00000_payment_invoice.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1fe33f3df6670929a11a7d312663e648e1262bdb1b01bb0f4a9deab2c1990372
Instruction ID: 3a78ad1ad49a3f2836b2fc0c3e83b94c240a80308f27e0e487e5d0d68a4a47a1
Opcode Fuzzy Hash: 1fe33f3df6670929a11a7d312663e648e1262bdb1b01bb0f4a9deab2c1990372
Instruction Fuzzy Hash: 9A11F2B1D042499FCB10DFAAC984BEEFBF5EF88320F10842AD459A7250D775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F09450 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00F094B2

Memory Dump Source

Source File: 00000004.00000002.2502643110.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f00000_payment_invoice.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8178f3909644a4347787c92f4c0f73c07a21537b531c3897d92385522423c070
Instruction ID: d6006fbc7e1e72e1a9cc07d5ed044b883a9d9cd5c5d11013ebb1e56f4da5080b
Opcode Fuzzy Hash: 8178f3909644a4347787c92f4c0f73c07a21537b531c3897d92385522423c070
Instruction Fuzzy Hash: B4113AB1D042488FCB10DFAAC4457DEFBF5EB88324F208419D459A7351D775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05DE3768 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

Deq, xrefs: 05DE3803

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: bf3d283df196e0607ea2e51f84bdba8d665ca16aab4b57d59581274b3380f7eb
Instruction ID: a5f14b215af0a372be6824e43f5fafb6cc6b2ed83ae44416ef8e42bbff3e7d67
Opcode Fuzzy Hash: bf3d283df196e0607ea2e51f84bdba8d665ca16aab4b57d59581274b3380f7eb
Instruction Fuzzy Hash: A5B17D70B006049FC714EF69D985A6ABBF6FF88710F15856AE405DB3A1EB31EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 055E9770 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

(bq, xrefs: 055E9A00

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a915267fc777ca28d2273d5f65760a628a95a6f17b4badaae53e25230660ccff
Instruction ID: de16ae739b22abc93efc3a3bf3ae9ef9366a96895f30e8cbec7de6232d240af4
Opcode Fuzzy Hash: a915267fc777ca28d2273d5f65760a628a95a6f17b4badaae53e25230660ccff
Instruction Fuzzy Hash: 7AA1A175A0025A8FCB08CF59C4C5CBEBBB2FF88214B548669D95ADB751DB34EC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DEB035 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

\Vl, xrefs: 05DEB28B

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 1cc6ae0557944dfbd4e01eb5b6ebfe9aa363adceb97efc42a8d86e2f780eb4b0
Instruction ID: faf5b9ec911bc6aa109e36608c8d708d1c753238c2314b1bf3c4987587381744
Opcode Fuzzy Hash: 1cc6ae0557944dfbd4e01eb5b6ebfe9aa363adceb97efc42a8d86e2f780eb4b0
Instruction Fuzzy Hash: 61917370E04209DFEF10EFA9C9857DDBBF2BF48314F14812AE455A7294EB74A885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055E8F60 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

(bq, xrefs: 055E9065

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a521ac716ebae650918c7286ebf0ac85183ebd00d3902e3f49f0bbcd96979c0a
Instruction ID: e986b829421b07aeceac361000b96bdc7ca32fa56589fc4f3157e3433d7ed036
Opcode Fuzzy Hash: a521ac716ebae650918c7286ebf0ac85183ebd00d3902e3f49f0bbcd96979c0a
Instruction Fuzzy Hash: 17715E70F006199FCB58EFA8C5546AEB7F6FF88300B108569D509E7394DE34AE02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 055ECA07 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

eMm^, xrefs: 055EC97B

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: eMm^
API String ID: 0-559167984
Opcode ID: 1ccc563be600fad5f321b16f15f22973defacdda6736c8f199dc639f288476a8
Instruction ID: e2d5a914ff359de93a2ebac0d782bf54f63dde9e9a5cfbd42671ca4c18d12202
Opcode Fuzzy Hash: 1ccc563be600fad5f321b16f15f22973defacdda6736c8f199dc639f288476a8
Instruction Fuzzy Hash: F3611F30709200CFD34DEB65E059B6A77A7FB88311F24C029E11A9B799DF74DD858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE3758 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

Deq, xrefs: 05DE3803

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: c8ab2cdfa681d3f602b886198aa9965e574620613d3cf6988952e741bafc3f3a
Instruction ID: 77f27bc36b5bbfdcee937d8cd0e46f67a9e4a1ab470b7eb1300948d6d30209ef
Opcode Fuzzy Hash: c8ab2cdfa681d3f602b886198aa9965e574620613d3cf6988952e741bafc3f3a
Instruction Fuzzy Hash: EE7149746006009FC714EF29D684E69BBF2FF89311B5585AAE406AB3A1EB31FC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055E0A90 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'^q, xrefs: 055E0ACA

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 601d330a5647697c00984fd55b0b3273f6522c183e64a894c0c9c2bb12178f85
Instruction ID: 6f0a9d2f8c148e1254632eb7108ce3bdcc72303df3332ab5f6deaf058c06158f
Opcode Fuzzy Hash: 601d330a5647697c00984fd55b0b3273f6522c183e64a894c0c9c2bb12178f85
Instruction Fuzzy Hash: 3A414230B106288FCB09AB64D858AAEB7F7BFC9700F105519E406AB3E4DF749D46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8D11 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

LR^q, xrefs: 05DE8D6B

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 5e5158771df1a09d870023d3e220f641ba67af8dbeeecd651133cef6e1bd8ea9
Instruction ID: eb1c9de0106a3c50e8addc99af475fcdfc61a4a66086ebd045a9817c9f229dbe
Opcode Fuzzy Hash: 5e5158771df1a09d870023d3e220f641ba67af8dbeeecd651133cef6e1bd8ea9
Instruction Fuzzy Hash: 8C41D030B112158FCB19BBB4C46967E36F3BBD8701B10486ED046DB394EE36CD129BA6

Uniqueness

Uniqueness Score: -1.00%

Function 05D910B3 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05D910D4

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 1947da041dc9bc97920ef28d4aa8ca2e1029955618f385ca4092b384e43c6d16
Instruction ID: f46ad321fd14eaf3880fdf50859b5d648fb78016d559696ebd9b3632badd70b8
Opcode Fuzzy Hash: 1947da041dc9bc97920ef28d4aa8ca2e1029955618f385ca4092b384e43c6d16
Instruction Fuzzy Hash: F64188757006019FCB18DFB9DA48A297BE2FF89215F1540EAE00ACB3B2DA32DC05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05D91117 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

TJcq, xrefs: 05D91146

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID: TJcq
API String ID: 0-1911830065
Opcode ID: 9c66e0a4af85c9da3076bbc5e7f3b2dafe5fc3c56d1c2f2397d54bdbeda2edfe
Instruction ID: fd1eec5c03692fa16a5c1be83c5fbc04382c4be63ade25d681edbf47bdb0ec93
Opcode Fuzzy Hash: 9c66e0a4af85c9da3076bbc5e7f3b2dafe5fc3c56d1c2f2397d54bdbeda2edfe
Instruction Fuzzy Hash: F83189343005109FC758DB6CC958F2A7BF6EF8A615B1500AAE40ACB3B2CA21EC01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 055E8628 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

xbq, xrefs: 055E8683

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: xbq
API String ID: 0-73991425
Opcode ID: ebeac80fc349792f78b042431f9c20f6128759a154dbd16a4298a77591ff531f
Instruction ID: 0c7aea95f2473083f483aa8d9190feee7c2b53b5a49c8f6aa1553289436599f3
Opcode Fuzzy Hash: ebeac80fc349792f78b042431f9c20f6128759a154dbd16a4298a77591ff531f
Instruction Fuzzy Hash: DB319335A04204DFCB18DF69D945BAEBBF2FB8D310F108465E159A7751DB30A884CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 055E0A81 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

4'^q, xrefs: 055E0ACA

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 1dbc5e717d943d9aa0b13d540aaf84c07a63bb5ad99f9f942bad937d61b38af0
Instruction ID: f20775d0b4942a9ff74c02cc79d6e440d1c1345deb2775ea1cdc5d0878ecb14a
Opcode Fuzzy Hash: 1dbc5e717d943d9aa0b13d540aaf84c07a63bb5ad99f9f942bad937d61b38af0
Instruction Fuzzy Hash: 3E219930B102184BC7186B65985C66EBBFBBFC9740F10442EE406EB3E5CEB44C46C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6220 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

\s^q, xrefs: 05DE629E

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: \s^q
API String ID: 0-4111632511
Opcode ID: 5df76cb25033382159c53ec2771da840990ab1c114dcb75b7decc745c846f0f0
Instruction ID: 1717fee91b4b13d9f958e17345f94b864cd62636b90ed5480316e5ebc7cfd257
Opcode Fuzzy Hash: 5df76cb25033382159c53ec2771da840990ab1c114dcb75b7decc745c846f0f0
Instruction Fuzzy Hash: 8E21AE317444208FCB54EBB9F844D3977E6EF9876475184ABE44ACB770EA21DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 051B1418 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

4'^q, xrefs: 051B241D

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 92982bd6080fc7c069f84ff121e0c24d77ca4c4026f2875a1042ab84c4d43888
Instruction ID: 14526122d09569b9102eeba0375d73d214aa5b66bb0ac7779c2c330e2cce74a9
Opcode Fuzzy Hash: 92982bd6080fc7c069f84ff121e0c24d77ca4c4026f2875a1042ab84c4d43888
Instruction Fuzzy Hash: B6212576E092549FEB265B60D8543FA7F72EF46251F0A00AAD811AB282DB785C09CB53

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6380 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

, xrefs: 05DE6741

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b00bbebd82130b7e1c8d0c3ee260942b084e503e97ac146b5c22d0c4705333cb
Instruction ID: 618cfcb67371261893b69df7dfca28e0ad9fdc5aab1e540acfd59335c186104f
Opcode Fuzzy Hash: b00bbebd82130b7e1c8d0c3ee260942b084e503e97ac146b5c22d0c4705333cb
Instruction Fuzzy Hash: E7217470B081098FC710EF98E9808AEF7F2FF98210B608067E5669B609D731DD06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 055E8638 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

xbq, xrefs: 055E8683

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: xbq
API String ID: 0-73991425
Opcode ID: a7677cbd3967e7dfaab4c2b1fbccde34d1dc3076a1e7837d4ae3571798b26da0
Instruction ID: 3f305be510f62676055c56ada5524b7842a4d3de7c1efd6270d9cd19c7e70d6e
Opcode Fuzzy Hash: a7677cbd3967e7dfaab4c2b1fbccde34d1dc3076a1e7837d4ae3571798b26da0
Instruction Fuzzy Hash: 1E318134A04208DFCB18DF69D945BAEBBF2FB89310F108469E519A7754DB31A884CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DEF208 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05DEF25B

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: a95c213536f8d586b80f14dcbd5ced3a7f0dac7fbb4debef0165c46206a4f971
Instruction ID: 3f31def5955d245076221171102549f6d1200456c1e599924105f36097998d2f
Opcode Fuzzy Hash: a95c213536f8d586b80f14dcbd5ced3a7f0dac7fbb4debef0165c46206a4f971
Instruction Fuzzy Hash: 7F214D70A00205EFDB14EFA8D4989AEBBB6FB88314F148159E505AB355DB34ED41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057FC1E0 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

J, xrefs: 057FC32D

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: ae735e29a133a602f24a9c117c5b469fc2bae485801d3bbb3aaa4ddfcd8965c0
Instruction ID: 6f4571179036c2b2c33e7542ac2a7f8342719eb7f05a11bb813f17c8a7feab0f
Opcode Fuzzy Hash: ae735e29a133a602f24a9c117c5b469fc2bae485801d3bbb3aaa4ddfcd8965c0
Instruction Fuzzy Hash: D3216831A0C22C9FD712EBA9D908F6A7BEDFB45350F054461EA04D7342CB26DC8197A2

Uniqueness

Uniqueness Score: -1.00%

Function 055EDC30 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

(bq, xrefs: 055EDC87

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 4ecbd474afd324372c09a8aac206887d4b60d826e19aa86112275b97d3a9e5f8
Instruction ID: a513ed43a050549fd69e9035e7b2bf702906031f163f6500118137dad29b796f
Opcode Fuzzy Hash: 4ecbd474afd324372c09a8aac206887d4b60d826e19aa86112275b97d3a9e5f8
Instruction Fuzzy Hash: CA1101717187948FC71D6B78282D17E3FB6BF92690304095AE10FEB6C2CE658C8183DA

Uniqueness

Uniqueness Score: -1.00%

Function 055EEBFB Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

LR^q, xrefs: 055EEBFB

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 5e11399f2482ef210db33437866575407c40208595fd95bb730ea06b0903a1d8
Instruction ID: 3d6d722908950bf99ceea0c008b5886392ec6fe60a20c06f9f3c75ea894e437b
Opcode Fuzzy Hash: 5e11399f2482ef210db33437866575407c40208595fd95bb730ea06b0903a1d8
Instruction Fuzzy Hash: 5F213E32F112355BEF089EB9D8144AE73E2AFD82057168969E8067B385CD34AD09C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 055E1BA8 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

(bq, xrefs: 055E1BFC

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 7ca40de2096a649685246b5b729b821d0c86d6f8eeb68227ee2c47d7b3921986
Instruction ID: e011e63060d8f439f678788bbc422bc94113c8e8e1bcae4ebdb407458dec84e0
Opcode Fuzzy Hash: 7ca40de2096a649685246b5b729b821d0c86d6f8eeb68227ee2c47d7b3921986
Instruction Fuzzy Hash: E5116036608254AFCB069F69D804D597FB6FF8A72071A80D6E509DB372CB32DC11DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DE6210 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

\s^q, xrefs: 05DE629E

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: \s^q
API String ID: 0-4111632511
Opcode ID: f3776dad41b50c59ff5751452b6eae57266614867607fd9c323baefb3745e94a
Instruction ID: c268ee1b4c8df04f34efd50c5cf702da37b1f672e48ae58024d4177cc70928b4
Opcode Fuzzy Hash: f3776dad41b50c59ff5751452b6eae57266614867607fd9c323baefb3745e94a
Instruction Fuzzy Hash: DB01D431B482118FD722EF75B81097A7BE7EFA6714B44C0ABE489C7261E660CC01C792

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7C49 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05DE7CC5

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: c4cf4dc43cf1137f6667413c052ed236a6b0e8a20d6d1a774033969cce47e95d
Instruction ID: bee1f348c240d1bd9827a0782533607483baa6db7ffcc83162d52d9e2765f979
Opcode Fuzzy Hash: c4cf4dc43cf1137f6667413c052ed236a6b0e8a20d6d1a774033969cce47e95d
Instruction Fuzzy Hash: 6D01D471B101519BCB54AB68CA59BBE7BFBEB88700F10045AE002FB380DEB58C0097E1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE3B23 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05DE3B33

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 2f444541c6d7c98d7ac6d005d9e12cf713ce17e702cc50c7b803ac3ecd4178e5
Instruction ID: 7448e7c8d549eed5ab6b73a925bced2484d315bcdfa230889b37673822b51ee7
Opcode Fuzzy Hash: 2f444541c6d7c98d7ac6d005d9e12cf713ce17e702cc50c7b803ac3ecd4178e5
Instruction Fuzzy Hash: E1E02B335083141ECB0AA75CF8427B577D9FB882217051CABC01ECB256E911AC854295

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7CC4 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05DE7CC5

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b35546f67244a9b58f4b706a74136625048aca9a3a148a86716713fc5d683827
Instruction ID: 3775c9a59d8691ee2cedf67ffe62a08412ddfacdecba90302f739da099d8654d
Opcode Fuzzy Hash: b35546f67244a9b58f4b706a74136625048aca9a3a148a86716713fc5d683827
Instruction Fuzzy Hash: DCF0F871B502158BCB54EB68D959BAE7AB6AB48704F20045AE002FB390CBB488049BE1

Uniqueness

Uniqueness Score: -1.00%

Function 051B5860 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8dc8e225c04b036d9cc443fbf35f62922dc8a06defbf1df16d8e8ac63ba29f1
Instruction ID: 04aecd74f9a7e3e54d0093c3cc42709d923ccf5846ae20facff91bdec2c771aa
Opcode Fuzzy Hash: f8dc8e225c04b036d9cc443fbf35f62922dc8a06defbf1df16d8e8ac63ba29f1
Instruction Fuzzy Hash: 85023C35A0421ACBEF29DF50C850BEEB773BF88304F558599D909BB240EBB15E858F91

Uniqueness

Uniqueness Score: -1.00%

Function 055E0CD0 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d64403ad5d75d361957af0d77f7e42bbde5f0940d32bddbdf5c297dc7f6ce0
Instruction ID: 28417bddcdb1390e2ad97a3d6d1a8f12c352b65d6b95543e6fba122094122c5b
Opcode Fuzzy Hash: 44d64403ad5d75d361957af0d77f7e42bbde5f0940d32bddbdf5c297dc7f6ce0
Instruction Fuzzy Hash: 8012EA34B002198FCB14EF64C998A9DB7B2BF89300F5195A8D54AAB3A5DF70ED85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 051B2D50 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429bb235d3a5d8359acbdb6305cc1c59950d0ef2d5ec044e006f8f23a5eaf728
Instruction ID: 1b5905edec5ebe2bcdb4ae295d353e329edb18beadb7e77d3c10fd504f802656
Opcode Fuzzy Hash: 429bb235d3a5d8359acbdb6305cc1c59950d0ef2d5ec044e006f8f23a5eaf728
Instruction Fuzzy Hash: 0BC153303506458BEB1856AAD5EC66BEABFAFD4700F50443DB207CB2D8CFE59C8587A1

Uniqueness

Uniqueness Score: -1.00%

Function 051B5108 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89bae9c68888718154110ccbb4d3ad2ea7f29d17c35c3397c8b5ad50a89186b9
Instruction ID: 4e5d04d944ecb4f17440632f9aeb0c2d3b33360e80b38bc3f77a878ea857fe71
Opcode Fuzzy Hash: 89bae9c68888718154110ccbb4d3ad2ea7f29d17c35c3397c8b5ad50a89186b9
Instruction Fuzzy Hash: 99B1C730304306D7EF28AB99C8D4BAAE1FBFFD0701F52463EC60696295EBE55C4585B2

Uniqueness

Uniqueness Score: -1.00%

Function 05DEBC4C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fee47997ba11d75cedf04825d2c19d67d24f31dfe5e23762061f4ecabf71d65
Instruction ID: ca171515693b75e6480dc933e62ab3200da0236f910c4c15c24f4e401aa3aedb
Opcode Fuzzy Hash: 5fee47997ba11d75cedf04825d2c19d67d24f31dfe5e23762061f4ecabf71d65
Instruction Fuzzy Hash: EEB15D70E04209DFEB10DFA8D8857ADBBF2FF48714F14812AE455A7294EB75A845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 051B630D Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f32b02e46bb124f59bc34c5acad1b97fa22c7c5efca95308afa6a4a315c3c03
Instruction ID: 9fbf9585c4d6ffd9c00ad895db0405101d23e268048932a9466ea4f7718962a4
Opcode Fuzzy Hash: 2f32b02e46bb124f59bc34c5acad1b97fa22c7c5efca95308afa6a4a315c3c03
Instruction Fuzzy Hash: 167105303117524BE718EE25C4D4BEEA3ABBFDA604F54813DD2069B289CFE5AD0987D1

Uniqueness

Uniqueness Score: -1.00%

Function 055EB27B Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850994122422818384657558ed7255935540a6841dbfe1ea03fe8c04a543727a
Instruction ID: 3359210366db8ad0bb7548c807586464778008a3a338c6a2ab75ea65160050fc
Opcode Fuzzy Hash: 850994122422818384657558ed7255935540a6841dbfe1ea03fe8c04a543727a
Instruction Fuzzy Hash: 87B12770A05209CFE70CCF59D988BAAB7B3FB88321F608169E0059B359C774ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 051B6328 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7c03f95d82de20fb9e9a0d35afd9af85d581b8abcc87b75ced950db9430b36
Instruction ID: c755ab62edcd555d8c52983b97dece4263e334327212880c6db29efec2326b39
Opcode Fuzzy Hash: 8a7c03f95d82de20fb9e9a0d35afd9af85d581b8abcc87b75ced950db9430b36
Instruction Fuzzy Hash: 0971F5303106165BE718EE25C4D4BEFA2ABBFD9600F50813DD2069B289CFE6AD0547D1

Uniqueness

Uniqueness Score: -1.00%

Function 055E0CC0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4981fd4ebe0e7cc708bdc15996a91123c8de65975a9f614aa43b6af4b9e7d2a
Instruction ID: 87a89912bed8a609bdede533fd6d2f4c25a5fa9af8a59595bcc90fd66647bd80
Opcode Fuzzy Hash: e4981fd4ebe0e7cc708bdc15996a91123c8de65975a9f614aa43b6af4b9e7d2a
Instruction Fuzzy Hash: 23A1DE34B002198FDB14DF64C998B99BBB2BF89300F5085A8E54AAB3A5DF74DD85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 055EB19B Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84bf477870d821f4659478c1a388ee8e53d35759e15aeb07075b36a262993455
Instruction ID: 02970308e9df2afe5108442b6277e49516349306bd2d68110e3324c93052d5b1
Opcode Fuzzy Hash: 84bf477870d821f4659478c1a388ee8e53d35759e15aeb07075b36a262993455
Instruction Fuzzy Hash: 29A13970A05209CFE70CCF59D988BAAB7F3FB88321F608169E0059B259D774ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055E1C68 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137edfce0a07db38556069e00e3f1f7e5589cca603e7e4d6e7a5e2ee0b29be69
Instruction ID: d6f1045f67af3f7be6e2a67d04a601ac85be8dfbd2f9c704f819cce1727fe60a
Opcode Fuzzy Hash: 137edfce0a07db38556069e00e3f1f7e5589cca603e7e4d6e7a5e2ee0b29be69
Instruction Fuzzy Hash: F5811A347106149FCB08EF68D498AAEBBF6BF89710F1441A9E506DB3A5CB74ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055E3E70 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194996391c7c5c1de540b427597778815488246a04ef705822efb41edca37d87
Instruction ID: edeba50bf4f3bfc9794d8ee707c0c7f53f70f38cd64ada16726e79a7f6878248
Opcode Fuzzy Hash: 194996391c7c5c1de540b427597778815488246a04ef705822efb41edca37d87
Instruction Fuzzy Hash: 19813E34700619CFCB19EF68C458AADB7F2BF89704F108569E4129B3A1CB75ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055E7DE0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d29ad639dd8fd47070ed29f0fbb061efa7e77535c30ad6149d0e46d43e8a3da
Instruction ID: 32cc9bae8fda1c5f448cdc3580fdfef327857b736cba060e06301baf75d410fe
Opcode Fuzzy Hash: 8d29ad639dd8fd47070ed29f0fbb061efa7e77535c30ad6149d0e46d43e8a3da
Instruction Fuzzy Hash: 78717D34B28200CFD71CEB65E449BAA73B3FB88311F24C465E419AB399DB749CC58B91

Uniqueness

Uniqueness Score: -1.00%

Function 055E7DF0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0941863c5091aa7174f7beec108d8b6fe7793ade1b03e4765df5cae62cb33e1a
Instruction ID: 63064bbcc1e15fe34acc966a646e526cbf6c09c17e694629840008b854e2639d
Opcode Fuzzy Hash: 0941863c5091aa7174f7beec108d8b6fe7793ade1b03e4765df5cae62cb33e1a
Instruction Fuzzy Hash: B5716C30B28204CFD71CEB65D449BAA73B3FB88315F24C465E419AB399DB749CC58BA1

Uniqueness

Uniqueness Score: -1.00%

Function 051B55C8 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb678e15e03dffeb4cf14e8c2854f7cfc9eefb87d5fe65e2172ccd375b56ba4
Instruction ID: 508814a4a98bbcf80fac53b744515e393cd23e027470eaca0346c484f44b838f
Opcode Fuzzy Hash: dbb678e15e03dffeb4cf14e8c2854f7cfc9eefb87d5fe65e2172ccd375b56ba4
Instruction Fuzzy Hash: 71615D35E0430ACBDF18DF94C8946DEBBB3BF88304F25852AD915BB244EBB19945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055EA5C8 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f567b39deb9c05e34e0f3951a1b751fe37fd175a52251c4fd55daf45ed6deb
Instruction ID: 88e97bb7e6fd0f82eafce2b08ef611bd3d31be7055d26f809b59c442145bbf40
Opcode Fuzzy Hash: c7f567b39deb9c05e34e0f3951a1b751fe37fd175a52251c4fd55daf45ed6deb
Instruction Fuzzy Hash: F3616E35A18204CFDB0CEB65D849BAE77B3FBC9311F248065E105AB289DB749CC6CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055E3E60 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87ddbef43ff7bbf631a3bb570a1f83daadda59d65b1cfd0a497e39782e412f4
Instruction ID: b2353c08162d7571979b28a39be746bf7f0bcfc7ee6f886d704c166609ff5ca4
Opcode Fuzzy Hash: f87ddbef43ff7bbf631a3bb570a1f83daadda59d65b1cfd0a497e39782e412f4
Instruction Fuzzy Hash: 6E618034710619CFCB19EF68C458AADB7F2BF89704F108569E4029B7A1CB74ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055EAA6F Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e47b9eed1d1ef20d3060ac7dbdc75a1ec783e32b02306d30def0cdee58914f9
Instruction ID: 38902286e5e72ee5b693cff361ae3caa30d5c68ffc313ff727b9d936928dab94
Opcode Fuzzy Hash: 9e47b9eed1d1ef20d3060ac7dbdc75a1ec783e32b02306d30def0cdee58914f9
Instruction Fuzzy Hash: 89616D31A08204CFD708EB79E459BAE77B7FBC8311F248029E409A7798DB705D85CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 055EC480 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39baf53393ea82accd9a0a94c50a9f35eea7140e3507b56d4bed98d739465431
Instruction ID: bd289cdf544d4d9e7ec73a7d652eaddc52ae6fc1fa599634937c717b4e967b90
Opcode Fuzzy Hash: 39baf53393ea82accd9a0a94c50a9f35eea7140e3507b56d4bed98d739465431
Instruction Fuzzy Hash: 6B515D34B08204CFD708EB69D459B6E77A7FBC8311F24C065E41AAB399DB34DC858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 055EA5D8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a732d1e18fe6654d61140a415efe30bc72f0c90a71a68e0a2ec12266865760
Instruction ID: b72b71b2f01765355e14a3fff021a0357dad9291b2a5bf6671370a9f4a48f033
Opcode Fuzzy Hash: 71a732d1e18fe6654d61140a415efe30bc72f0c90a71a68e0a2ec12266865760
Instruction Fuzzy Hash: F3615E34A18205CFDB0CEB65D849BAE77B3FBC9311F248065E105AB289DB749CC6CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055EAA80 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f1c66f200d3cc74ca7bcc48b64fcfa2a6f6cb42649c122683020050d49ba7a
Instruction ID: e9a2e0be9e7d89137c1f93d74ce07db59bdf9fc96b5c3e6430a70e026a48415d
Opcode Fuzzy Hash: 64f1c66f200d3cc74ca7bcc48b64fcfa2a6f6cb42649c122683020050d49ba7a
Instruction Fuzzy Hash: 56514E31A08204CFD708EB69E559BAE77B7FBC8311F248029E409A7798DB745D85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 055E1C58 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71080d04ca6771559c63763d926f685e30e98844a69b993346ec9e5b3152f308
Instruction ID: 8fce561b6ccbc10b705ee4f133adc48a2c4c64c8b54012e304c8519891aff636
Opcode Fuzzy Hash: 71080d04ca6771559c63763d926f685e30e98844a69b993346ec9e5b3152f308
Instruction Fuzzy Hash: 6461FA35710614DFCB08DF68D498AAEBBF6BF89710F148169E5069B3A5CB70ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055EA070 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968513837d732ab506a14e2c5333dbd0863a6856f5e2454869c8cc1569d61d4
Instruction ID: d36d85990f54b532a0caa719825423c1e3be09f68cee8504f26890d240680d92
Opcode Fuzzy Hash: 7968513837d732ab506a14e2c5333dbd0863a6856f5e2454869c8cc1569d61d4
Instruction Fuzzy Hash: BE51AC32708205CBE70EDA75C449BBA77A3FBC8310F108975D4069B689DB78AC858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 057FAE48 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6c02a0b1d2ef86705ff3e9199b4fd73d645c6c378f7b471b9cecd6de60f8d2
Instruction ID: e1d440288644ff55b2b9361cb4d09aefde9041a5ab931b72ff47a44a2b23b061
Opcode Fuzzy Hash: 7a6c02a0b1d2ef86705ff3e9199b4fd73d645c6c378f7b471b9cecd6de60f8d2
Instruction Fuzzy Hash: EB516E34718200CFD708EB75D05A72A77A7EB88314F20C125E51A9B389DB389DC6DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 055EC472 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d700e5a26437733b84ed5e41c25630df3bc99067ec4230ddbd80e383b1068e
Instruction ID: 2c9f878f8ef08daa6aaa12af53a402b1ba01641cbfc8e5e8bc4f2579d9287917
Opcode Fuzzy Hash: 95d700e5a26437733b84ed5e41c25630df3bc99067ec4230ddbd80e383b1068e
Instruction Fuzzy Hash: 3E517F34B04204CFD708EB69E459BAE77B7FBC8315F248065D41AAB399DB34DC858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 055E7778 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89deae39ba02926c67c0313c1302bec1a7566810501d69f1462eaadd95be88e2
Instruction ID: 56c9fe891adbb4bf9e3a184027f6c7f671c589611486636a96e126594b9ebae3
Opcode Fuzzy Hash: 89deae39ba02926c67c0313c1302bec1a7566810501d69f1462eaadd95be88e2
Instruction Fuzzy Hash: 9351AD34615240CFC708EB69E445B6BB7B3FB88310F268569D40A9B389DB709DC6CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 055EC670 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0920db398fcf482150ba54d7b50f827f31067d6bff042e06f3996151b50f6fe0
Instruction ID: fde9b132fc4a66c4116a4003f5ea493a6e9fb9a007311fd27ccb55f846ed0370
Opcode Fuzzy Hash: 0920db398fcf482150ba54d7b50f827f31067d6bff042e06f3996151b50f6fe0
Instruction Fuzzy Hash: F7513A34B04204CFD708EB69E459B6E77A7FBC8315F248065D41AAB399DB34DC858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 055EB7F0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a974a1cf146d481b01ea00d141c0f8381e4911657003d9b427db03ce667d6b7
Instruction ID: 357a20ce016567bbec4ffab5e8ea7b961660b5269d4f0eb17cd824f210c6ddaf
Opcode Fuzzy Hash: 8a974a1cf146d481b01ea00d141c0f8381e4911657003d9b427db03ce667d6b7
Instruction Fuzzy Hash: 87514A35A08205CBDB0CEA65E455BBA77B3FBC8322F248466D405A7798DB34ACC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055EB800 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6a908be671aaa5c2e1027156f0c2fb99b6c1521572856c0bd5f58f8a1e89ee
Instruction ID: 1b7b43c7589d25e4b6b04680c08d82570b50acdfdae65188acc259c95959033f
Opcode Fuzzy Hash: 7c6a908be671aaa5c2e1027156f0c2fb99b6c1521572856c0bd5f58f8a1e89ee
Instruction Fuzzy Hash: DC514A31B08205CBDB0CEA65E455BBA77B3FBC8322F248465D405A7798CB74ACC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7970 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7609bce4b92b41d38a64c2f01b39f99aff92763dafa525e50e8aa0b303427e6d
Instruction ID: dbfee94c40c40785382191f7861f5b09f204f98115bec61cab724a742288f02b
Opcode Fuzzy Hash: 7609bce4b92b41d38a64c2f01b39f99aff92763dafa525e50e8aa0b303427e6d
Instruction Fuzzy Hash: 4441AF30A05244CFCB45EF68E4596ADBBB6EF88310F04482AE446AB391DF75DD45CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7960 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eec2995c9f5409d9137260b788618a18283b6ebfa3cf5770655c095803be51a
Instruction ID: 11b6d4a63c6fec4160f447a54f78c5255230b3180c48992d62a2ac41cf343377
Opcode Fuzzy Hash: 4eec2995c9f5409d9137260b788618a18283b6ebfa3cf5770655c095803be51a
Instruction Fuzzy Hash: CB51C230A05280DFCB45EF74E4596ADBBB2EF84311F04482AE446AB391DF75DD45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 055E5408 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d63bcb6599b62e6853a13c8835f3812609ebbea64294c10af0dc1075191d501
Instruction ID: d3cc1fb4c3a235a786a532b0a98e7c1a51e1880da1cb0e8db63114f47cd6fcfe
Opcode Fuzzy Hash: 2d63bcb6599b62e6853a13c8835f3812609ebbea64294c10af0dc1075191d501
Instruction Fuzzy Hash: AE41DF31B007149FCB64DBB8D5446AEBBF2FF84654F40896EE15AD7A90EB30E941CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05D9DB28 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55dac811669db6f96e8c225911ec2bb3fd3634408a5cc01af67192ad7bad45f
Instruction ID: 922befae8c55b79f0fc2aa13e354a0130500d22f826fd49ed31d60eebbfdc20c
Opcode Fuzzy Hash: e55dac811669db6f96e8c225911ec2bb3fd3634408a5cc01af67192ad7bad45f
Instruction Fuzzy Hash: A4512F71A006059FCB14DF68C58499ABBF6FF88310B14C66AD809DB355EB74EA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8950 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe42dcb56185dfec2fdeb570c36153e4400176eadf945f57acee0b8c4312409
Instruction ID: 39e6bd3deceb02ca79e59605b37a035c995ff32a2dc27d7b972a765355e143c3
Opcode Fuzzy Hash: dbe42dcb56185dfec2fdeb570c36153e4400176eadf945f57acee0b8c4312409
Instruction Fuzzy Hash: 014174315113068FC712FF78E64959DBFB6FF84310B404A29E0468B669EF70A9498BF2

Uniqueness

Uniqueness Score: -1.00%

Function 055E597F Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400cb231ab16c3ece98d2ff57afe6e455e8d03cd0704ec8b59111804685dfc1c
Instruction ID: a932c08bd0cf32bac03021d530d1ff570cff2796bf2a9fa7a5baf80dc4c0a3d0
Opcode Fuzzy Hash: 400cb231ab16c3ece98d2ff57afe6e455e8d03cd0704ec8b59111804685dfc1c
Instruction Fuzzy Hash: 3341D531B106099FCB259F68C8467AEBBF6FF85711F108569F506DB380EB30A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055E5838 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5db9508bafcf5f406327542873af2a247ddc2689a2d8d90dda90a9d520557e4
Instruction ID: ca5554d41a7ee04cb4d27015383d52239ca27669fbeac8d3c023866058c2b787
Opcode Fuzzy Hash: e5db9508bafcf5f406327542873af2a247ddc2689a2d8d90dda90a9d520557e4
Instruction Fuzzy Hash: 10417A75A047449FCB24CF69C944A6EBBF2FF88304F188959E58697A51EB30E904CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05D91B98 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f98fe47034b3681466fd7c2c10617c4a9ccc0c30c2e14c304cab84aba8e115
Instruction ID: 5d54d70c625414b3f139379fa81e0997c46fd68dcd4155b5f283a3ee05e1e818
Opcode Fuzzy Hash: 04f98fe47034b3681466fd7c2c10617c4a9ccc0c30c2e14c304cab84aba8e115
Instruction Fuzzy Hash: 3A416039A04208DFDF19CBA8D485AADBBB3FF84311F494597D44AAB651D730E8C6CB41

Uniqueness

Uniqueness Score: -1.00%

Function 055E774F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c30c5be36212f4f143e00fa560c9cd57654a38d095c83724e97db4070ef37e5
Instruction ID: b614d102c6208b1f9d5bce9df9823edde4ecced730168f628dba8d77f51504af
Opcode Fuzzy Hash: 6c30c5be36212f4f143e00fa560c9cd57654a38d095c83724e97db4070ef37e5
Instruction Fuzzy Hash: 7341D270615380CFC709EB25E44576BBBB2FF89310F1685AAC1059B389DB309D86CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 055EA33B Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6974d37fdec7fcc7ab204f781ab7eed1f78b9ec46724706fdb5211458bf80a
Instruction ID: aa735e894dc12936c8f7247e3b5107cdd20b7f5e93e423c878f6d6d7bf098add
Opcode Fuzzy Hash: 2c6974d37fdec7fcc7ab204f781ab7eed1f78b9ec46724706fdb5211458bf80a
Instruction Fuzzy Hash: D0419A32608605CBE71FDA74C44DBBAB7A3FB84314F108A75D4069BA88C738ADC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DE79B1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc99be2d89ce026f7ea71bc5d97d1bd3aabeee3be1da5c6a89d8e54968403cb0
Instruction ID: 11d607eb112c533275c5e9d221b73d9d72efe95e19523e29689b01af65bfacb8
Opcode Fuzzy Hash: bc99be2d89ce026f7ea71bc5d97d1bd3aabeee3be1da5c6a89d8e54968403cb0
Instruction Fuzzy Hash: 3541A030601284CFCB45EF64E4596ADBFB2EF84310F04486AE4469B391DF75DD45CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DEE3B8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a3f83f0b42ceb74638fcbb8b603aaed959566f49f1314d9ba17db541d7161d
Instruction ID: cb2a938b6176a9c218503cb4e94223d4a5f635512dd5a31c1b50886cae48f65f
Opcode Fuzzy Hash: f3a3f83f0b42ceb74638fcbb8b603aaed959566f49f1314d9ba17db541d7161d
Instruction Fuzzy Hash: 5331AE317006118BCB19FA7888246AD77ABEF88245F10042ED046EB3A4EF3ADC05C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7A95 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca70a41b8b29b32b1486218ce815051b0b0c10de460706648213201acb406b7
Instruction ID: cdd08e63bb91cae96dfcb84a15791a78129ba3c79177d9bf6f73950bc16f2bf8
Opcode Fuzzy Hash: 8ca70a41b8b29b32b1486218ce815051b0b0c10de460706648213201acb406b7
Instruction Fuzzy Hash: 11417F30A01284CFCB45EF68E4596ADBFB2EF84310F14886AE446AB391DF75DD45CB62

Uniqueness

Uniqueness Score: -1.00%

Function 055EA438 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf81a0947c885ef5192eac0c82666df201e0e06439c47d2b3e13b4e1383c04d
Instruction ID: b89b918da31e36c54e0e2eb8b8aefa7b8858bda9d6d340b83e757c00940ec602
Opcode Fuzzy Hash: ddf81a0947c885ef5192eac0c82666df201e0e06439c47d2b3e13b4e1383c04d
Instruction Fuzzy Hash: 77416732608605CBE71FDB74C44DBBAB7A3FB88314F108965D1069B688C778AD85CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 057F35E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e510b4830df8cc6ca982a2d2e71812780d890ab4fcc1b671ec55be552b13dc30
Instruction ID: 2f82a35364b32ae4e0b1493e2c20034ba0f8efdc32e938f98eb4a0f789b83506
Opcode Fuzzy Hash: e510b4830df8cc6ca982a2d2e71812780d890ab4fcc1b671ec55be552b13dc30
Instruction Fuzzy Hash: C531C235B04110CBDB04EABAE84967EB6A6FBC8311F104539DA1AE3344DF358D815BA2

Uniqueness

Uniqueness Score: -1.00%

Function 055E1F78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0872a018a8ca67256768cf342c483366bb6f854bd621c9eed309170af2a21cc
Instruction ID: 46dbd4ff1d23abaa36361f4aa61328f9cde88fb4c9897beb83441f87f0c616e2
Opcode Fuzzy Hash: d0872a018a8ca67256768cf342c483366bb6f854bd621c9eed309170af2a21cc
Instruction Fuzzy Hash: BD313035B002199FDB15DFA4D859AEEBBB5FF88310F108025E816B73A4CB75AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DE989C Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7986eb7f7504b7b821beda84e4794fe854ccff06faf3f7ca65da956c3ffb3887
Instruction ID: d41985f8496aa5c4a44d4b1954526a56cde59361e5279e7cf2ece62fce6f8c96
Opcode Fuzzy Hash: 7986eb7f7504b7b821beda84e4794fe854ccff06faf3f7ca65da956c3ffb3887
Instruction Fuzzy Hash: 4A41FFB0D01349DFCB10DF99C994ADEBBF5BF48310F20802AE419AB254DB759985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DE98A8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c769804ce91d664f265adc8a99352da7320aa68b146d7eba5771a22f69c808
Instruction ID: f1c8034f78f214aa7b2af25049ef09f70458ef4b4dc0a57bdadfff620fcafae0
Opcode Fuzzy Hash: 37c769804ce91d664f265adc8a99352da7320aa68b146d7eba5771a22f69c808
Instruction Fuzzy Hash: D441DEB0D01349DFCB10DFA9C994A9EBBB5BF48310F10802AE819AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 051B66B1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf7f6c8e8bd13471ea1e4d7177e982976f1c7482ec634c4b45f8e193894aed
Instruction ID: 99c2086b8824e48c25bf3d584c78af1d0724d5f30849788cd0b49d8419366c99
Opcode Fuzzy Hash: 7ccf7f6c8e8bd13471ea1e4d7177e982976f1c7482ec634c4b45f8e193894aed
Instruction Fuzzy Hash: 83213A217097D24FE71AA63588E47B75B77BFE2510F1981BEC1158B187CFA88C0593D1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7B8A Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d5c1ae6ea0b31c41216066f8917ea4636878105850bfc98439875e60693f8b
Instruction ID: 7b44a1a617223dd33e419f010ade81a8e30ea2a98b975537572636c72b4e0c94
Opcode Fuzzy Hash: 31d5c1ae6ea0b31c41216066f8917ea4636878105850bfc98439875e60693f8b
Instruction Fuzzy Hash: 34317030B013408FCB45EF74E4596ADBBB2EF84311F14892AE4069B395EF75DD458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 051B5991 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ff4bc7a46a40a19a1435386f6fb1d3372d74f3df21fdbbfcdf2eb74abf3e7f
Instruction ID: 0cf30b936734ce3c3b2cfbaeadb2c6e50d52b61f2b691afeacab0c1add7176f8
Opcode Fuzzy Hash: b8ff4bc7a46a40a19a1435386f6fb1d3372d74f3df21fdbbfcdf2eb74abf3e7f
Instruction Fuzzy Hash: 5031F874B04225CBEB38DB10C594FEAB3B3BB98704F1641D9D909AB254E7B0AD808F91

Uniqueness

Uniqueness Score: -1.00%

Function 051B66D0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c107ae1f2a5533e86d8a56cca1a287398be581073f9476a112050b010f20238
Instruction ID: 89d0afe8373ccb2dbe65b60f73dad5d726cd2a4712eaae9d602b9a7733724c88
Opcode Fuzzy Hash: 3c107ae1f2a5533e86d8a56cca1a287398be581073f9476a112050b010f20238
Instruction Fuzzy Hash: 4921062670475657F72CBA2AD4E87BB91ABBFE1610F24813DC61A47289CFE99C0253D0

Uniqueness

Uniqueness Score: -1.00%

Function 051B5A45 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0267cedab609b08e5c7dfccb9bfaac9e73066f8a30eae3271ccbb1df9e3b0435
Instruction ID: c76a04c6701d7881df60e7c496f73e1302bb2c66de8baade106b3b362db030cf
Opcode Fuzzy Hash: 0267cedab609b08e5c7dfccb9bfaac9e73066f8a30eae3271ccbb1df9e3b0435
Instruction Fuzzy Hash: 14310A74B04225CBEF38DB10C594FEAB3B3BB58704F1641D8D909AB254E7B1AD808F91

Uniqueness

Uniqueness Score: -1.00%

Function 05D90007 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f873cb4853ffb8bca29ee324ebd776e1f8ce5f024dc2232ceeeb8b43d20b0557
Instruction ID: 0b2466d843ebaef6f3ef2d0883a1e2e37031d9bc4ac282ec3f459d89192a1b95
Opcode Fuzzy Hash: f873cb4853ffb8bca29ee324ebd776e1f8ce5f024dc2232ceeeb8b43d20b0557
Instruction Fuzzy Hash: 7931C5709083859FDB26CB69E9497E97FB2EF45310F1984A7D044D7292E7344DC8CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2501408840.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d7d000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d03930d7f0b9b97cd67762aced0497f896b1b718707cbe16d9a8bde93d84c93
Instruction ID: f9cb0745c53ef36f72d3b45027edb33d34e3f5bb7cb3c4f626a08759c67dc5ee
Opcode Fuzzy Hash: 8d03930d7f0b9b97cd67762aced0497f896b1b718707cbe16d9a8bde93d84c93
Instruction Fuzzy Hash: B321E071504204EFCB059F14D980B26BF76FF94328F24C569E94D0A256D336E856C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 051B5AFE Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d951c2132c4deb31646d5c33c4a95803e4545f0c3cd618ce4f6ad55e78df0da
Instruction ID: a6987856bd41cee66b87fafd52246ec9cdbc839fc32eff24ef9dda168a691c12
Opcode Fuzzy Hash: 4d951c2132c4deb31646d5c33c4a95803e4545f0c3cd618ce4f6ad55e78df0da
Instruction Fuzzy Hash: FE310A74B01225CBEF38DB10C594FEAB373BB58704F164198D909AB254EBB19D808F91

Uniqueness

Uniqueness Score: -1.00%

Function 05DE5A70 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b202f143cd5ff7ca0c17d587cbbbff4d1d5087e365cc381f5cf850ba35514e05
Instruction ID: 928f7a7b87a5f89a9513cc6b4c0d80deddb945a375cf4f2f0eb9750443eebcd3
Opcode Fuzzy Hash: b202f143cd5ff7ca0c17d587cbbbff4d1d5087e365cc381f5cf850ba35514e05
Instruction Fuzzy Hash: 3D2154317483545FC305EB788CA4B6A3FE6AFCA310F1448AAE049CB3E2DD658C0583A2

Uniqueness

Uniqueness Score: -1.00%

Function 051B55AD Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ce2c0d1fa4b8b9cb15a4a555453075d036530695222741fba5956ed84e4e9a
Instruction ID: ee7ef21d4a74d9f6b5b2a11661b1bc84774361ef7caf3614b41ea80223bfde9f
Opcode Fuzzy Hash: a4ce2c0d1fa4b8b9cb15a4a555453075d036530695222741fba5956ed84e4e9a
Instruction Fuzzy Hash: 4421C431E0424A8BDF19CFA8C8507DDBBB3FF88304F15812AD805BB640EBB09945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 051B65E5 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1491994d434bd0eb21602cd0e95e68b7302ae37666c1937bcfda4f18b211ce35
Instruction ID: a0aa8fa5ee1cb104c3145e7c9e72fe87de7727b5b42abf8a341b4a900f670169
Opcode Fuzzy Hash: 1491994d434bd0eb21602cd0e95e68b7302ae37666c1937bcfda4f18b211ce35
Instruction Fuzzy Hash: 0F113835B043518BD7299B258C44BBBBBF7BFD1710F08856ED415E3241CBB49805D790

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8EC0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20f02c6696da4cc0a1256381c6073e708ed298998c761d296775d39fdae33c7
Instruction ID: aff058c8952f9331d75f0b4a8acaf6c31b76e3c6f79c87c3f45876d8c21ef65e
Opcode Fuzzy Hash: f20f02c6696da4cc0a1256381c6073e708ed298998c761d296775d39fdae33c7
Instruction Fuzzy Hash: F9212C31B00219CFDB24EB68C5586AE7BB7EF88714F10406AD506AB361CF75DC45DB94

Uniqueness

Uniqueness Score: -1.00%

Function 051B5BB7 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1531753d52f8cad500b3b7a25b0f0a9c0a7fd79bf0a8662c1caef1f5562bdb
Instruction ID: 0a1bfd111eebdd7a892fed9c7c659a4cd20b73383beafe809be4e03ebecb0b66
Opcode Fuzzy Hash: 4a1531753d52f8cad500b3b7a25b0f0a9c0a7fd79bf0a8662c1caef1f5562bdb
Instruction Fuzzy Hash: 2B21F974B11229CBEF39DB10C594FE9B373BB58704F164198D90AAB290EBB19D848F91

Uniqueness

Uniqueness Score: -1.00%

Function 055E842F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa27a2f3e0b349c862ac0fcd57fa2acb3c0a6ad70ee6ec72065ae4a28998f56e
Instruction ID: 9650669e47b6b0b9c67dbb84e65acae6c514ce5395e59c9bf6bcc05c0e3f9430
Opcode Fuzzy Hash: aa27a2f3e0b349c862ac0fcd57fa2acb3c0a6ad70ee6ec72065ae4a28998f56e
Instruction Fuzzy Hash: 24216030A04205CFCB18EF69E5557BE7BB2FB84305F108569D01A97644DB7489869F92

Uniqueness

Uniqueness Score: -1.00%

Function 051B6600 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ebdde9e96aa38eaa5875fdf51c5a3929d81db0687e9e673e8c7a325d57b5cf
Instruction ID: 867a458c4d522e5976f666ad273a857e9b1e6e5adc7fd268b5969f758f49d466
Opcode Fuzzy Hash: c5ebdde9e96aa38eaa5875fdf51c5a3929d81db0687e9e673e8c7a325d57b5cf
Instruction Fuzzy Hash: 31110635B042159BEB2C9A2A9844BBBF7FBBFE0710F14853DD516A3244CFB1AC00D690

Uniqueness

Uniqueness Score: -1.00%

Function 051B5C6D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a1a66b1ac0fe353bac288bfdb98ba144a9d2a3475bd6ee66c8009dec5d52aa
Instruction ID: af331d21ee6f87619035a35743958176821ff4fd3d659f9e620dcfb06a802220
Opcode Fuzzy Hash: a7a1a66b1ac0fe353bac288bfdb98ba144a9d2a3475bd6ee66c8009dec5d52aa
Instruction Fuzzy Hash: 14212F74B11225CBEF39DB10C594BE9B373BF58704F1245D8D90AAB290E7B19D848F91

Uniqueness

Uniqueness Score: -1.00%

Function 055E8440 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f2642640915f96a46733808603dedab6a05cf12a286e151eedd7ec29a68a91
Instruction ID: d0d0527448f33500580ef1f45446a7e18d6e97b2ca2dfa244b56fac92b587be1
Opcode Fuzzy Hash: 49f2642640915f96a46733808603dedab6a05cf12a286e151eedd7ec29a68a91
Instruction Fuzzy Hash: 78218130A04219CFCB18EF69E4157BE77F2FB84305F508479D01A97784DB7499898F92

Uniqueness

Uniqueness Score: -1.00%

Function 051B6E81 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5887a168a05bf30bd98331440b35fe8b3b9d4f09b80dcf705d9dc27432de34ba
Instruction ID: c07fad7bd95ddaf2598ce8b5e66bb63764a6412c5d23888d98bb7544b6f079c2
Opcode Fuzzy Hash: 5887a168a05bf30bd98331440b35fe8b3b9d4f09b80dcf705d9dc27432de34ba
Instruction Fuzzy Hash: BC11CD3530D3415BE7169659C860BA7AB7ABFD6200F1941BFD009DB686C7F65C0887A1

Uniqueness

Uniqueness Score: -1.00%

Function 057E0EA8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7884e85a4eb2efb1b99bd32dd1ffc1da13b7480fc81a2bcfc70129578f0c5fc0
Instruction ID: 9ad9e89c8309b4f125cebaf1edcdab904cda767c76d50f9444b23f93d3de1ba3
Opcode Fuzzy Hash: 7884e85a4eb2efb1b99bd32dd1ffc1da13b7480fc81a2bcfc70129578f0c5fc0
Instruction Fuzzy Hash: 81214A75D08318CFDB55EB28C888AA9BBB1FB48300F1480E5D80DE7355EAB49E81EF50

Uniqueness

Uniqueness Score: -1.00%

Function 057E0F58 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3041a75f70a8d1ceb38aaf1ab3cc0cb57a0b2302fd9049ba9c12887107079b
Instruction ID: 812422335f47f0fa7f36aa5214986752984f8d7515f12a69f3138d76ab68340f
Opcode Fuzzy Hash: af3041a75f70a8d1ceb38aaf1ab3cc0cb57a0b2302fd9049ba9c12887107079b
Instruction Fuzzy Hash: 1621D774E04218CFD755EF64D854AA9BBB1FB48300F1080E5E50DA73A5DB78AE81DF61

Uniqueness

Uniqueness Score: -1.00%

Function 051B5CEF Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbb1e2e64cc9d225088dd0080a1b12949a5fd27859629aa873c5e3fd7cc1d37
Instruction ID: 67dfbc7d22cfd096c71b2050f55c19811105feeb707862e2d1726e9087ac8353
Opcode Fuzzy Hash: 8dbb1e2e64cc9d225088dd0080a1b12949a5fd27859629aa873c5e3fd7cc1d37
Instruction Fuzzy Hash: 77211D34B11229CBEF39DB10C994BE9B373BF58704F1641D8D909AB290EBB19D848F91

Uniqueness

Uniqueness Score: -1.00%

Function 05D9D7E0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b2a869bf20271510e99cd42352058957c105f20514c4afde7b525b0c174030
Instruction ID: b23732207d6cdee66e899e7710c56196d05b5b0741b9cbf784f8b4d6f53faf62
Opcode Fuzzy Hash: 40b2a869bf20271510e99cd42352058957c105f20514c4afde7b525b0c174030
Instruction Fuzzy Hash: 11118C72B142149FCB24FB6CE804AA27BE7FF84291B058097D809C7252DF25DC46CB97

Uniqueness

Uniqueness Score: -1.00%

Function 05DE4552 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbae8bc46f74de63c9ba39d03de564030f820af3940b2fc28f54383f55ff8514
Instruction ID: 62ce003815b9494e7def963d69a2193e4a46d2aaf65384c0bba88922029b0edb
Opcode Fuzzy Hash: cbae8bc46f74de63c9ba39d03de564030f820af3940b2fc28f54383f55ff8514
Instruction Fuzzy Hash: A8210838A04208CFCF05EBA4C954A6DB7B6BF4A310F158597D856AF364C734EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055E7C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5993ef43496cc20bb12afd70a3be4e1ddfbdf0e4db66bdf36c81b20ddca464c
Instruction ID: 0d46f9e170b452a5ce8ae0055ac726ed4d03e23a63f6485df878815f949f6183
Opcode Fuzzy Hash: f5993ef43496cc20bb12afd70a3be4e1ddfbdf0e4db66bdf36c81b20ddca464c
Instruction Fuzzy Hash: 55118231618681CBD718AA51D00572B7677FBDC312F248535D80AA7789DA789CC24BD1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE5AA0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbcd5a5090c7e0f93efefbc52613f81dca2c26e0106d66c628536e8510c14331
Instruction ID: 51a25cf2f24defeaa7624925a09af67d1fdb7d6236cb9a683169a37e77136bd3
Opcode Fuzzy Hash: bbcd5a5090c7e0f93efefbc52613f81dca2c26e0106d66c628536e8510c14331
Instruction Fuzzy Hash: E9015E307402186FD348EA7E88A5F6B6ADBEFC9750F144879A10EDB395DD629C0247A1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2501408840.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d7d000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: b57c37414722e511d00da09cc942299d10dfb475de688e4b5de79fc1820293fb
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: D311D376504240DFCB06CF10D5C4B16BF72FF94324F28C5A9D9090B656C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 051B6EA0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5d95ee5c11f724853d2b388d8d36b675ddd61e09b6803404f9ae47015cbf4c
Instruction ID: 8c81cc533f47338222e9dbb3d862e17a479e460e6134c124c85bc982294e7e34
Opcode Fuzzy Hash: 3e5d95ee5c11f724853d2b388d8d36b675ddd61e09b6803404f9ae47015cbf4c
Instruction Fuzzy Hash: 1F01B535309205A7E718AA49C8A0BA7E2AFBFD5610F24813DD11D97388CFF79C4547E1

Uniqueness

Uniqueness Score: -1.00%

Function 055ED160 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af68d0607e364a8e0dbc9770aff9be7b0c24577feabe768b79782791b8d6e02
Instruction ID: 0e9601d25c89856115631d3f934cc45b03bb359a5e9c109e8370fa25a7ceabcd
Opcode Fuzzy Hash: 1af68d0607e364a8e0dbc9770aff9be7b0c24577feabe768b79782791b8d6e02
Instruction Fuzzy Hash: E41167728002499FCB14DFAAC845BEEFFF5EF88320F148819E559A7250CB399584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 051B5D6F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a2c4710d5ad4aab9e2a6806c2a709ba527a15c3e719cf8e4690d7d813966fe
Instruction ID: 54842b4a2661eb5d3d08c68d2268b753408e71d8646b3fc311213a0c196e5d56
Opcode Fuzzy Hash: d4a2c4710d5ad4aab9e2a6806c2a709ba527a15c3e719cf8e4690d7d813966fe
Instruction Fuzzy Hash: 80211A35B10229CBEF35DB10C994BEDB373BF58704F164198D909AB290EBB19E848F91

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8DCA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c51c5e5b1d2c795eef260113ef4ac6a79b9d3a0e80fe3ef6a3e092a4351ba5
Instruction ID: 26502ad59ede53da317d8ce8b234bdb64887f30e505c29911906518b06472c7b
Opcode Fuzzy Hash: 73c51c5e5b1d2c795eef260113ef4ac6a79b9d3a0e80fe3ef6a3e092a4351ba5
Instruction Fuzzy Hash: F2115A317112188FCB1ABBB4D45956C33B2FBD861671008A9D0469B3A4DE3ADC52DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 055ED168 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c160d74433204c2dac491d473386fe742ceba8dc58ace82ef442c8d3ffa7b2
Instruction ID: 9b978e847f3d60951dceaa323c78f53787a0af0871bdbcbbd02ba4f2f41789ff
Opcode Fuzzy Hash: 93c160d74433204c2dac491d473386fe742ceba8dc58ace82ef442c8d3ffa7b2
Instruction Fuzzy Hash: A21137718002098FDB14DF9AC945BEEFBF5EF88320F148419D559A7250D7399584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 055E7C10 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969295fbd71a8377e08220a503343c7cd55424b7a7bfced0884aa2ce1b958fea
Instruction ID: 1a550cc5b79cde19181d7199eafb5c13d4d9a186d38606cac3fb18e645f4fe90
Opcode Fuzzy Hash: 969295fbd71a8377e08220a503343c7cd55424b7a7bfced0884aa2ce1b958fea
Instruction Fuzzy Hash: 11113031618681CBD71CAA55E00573B727BFBC8712F248535D80AAB789DF749CC64BD1

Uniqueness

Uniqueness Score: -1.00%

Function 055EDFD0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c049854b38293a2b746922245b7d653784f8dd0b168cbbc51c88c1d5c4664b
Instruction ID: 0d96fec442a13238d61cafbdcc34975d57815205da3872130b68a98b713bacde
Opcode Fuzzy Hash: d3c049854b38293a2b746922245b7d653784f8dd0b168cbbc51c88c1d5c4664b
Instruction Fuzzy Hash: 3601D274D1420FEFDB15DFA4E4427BDBBB5FB00300F10A9A9D016DB280EE3626418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 055EEBE3 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c80c40cedb1e8b25057dab4826ec862f761bc176353adbd48781bcf130d6f3
Instruction ID: 3ce2deb0836df125596314e07864b7633d4afa1a5f5efc084514a82148c027b5
Opcode Fuzzy Hash: 15c80c40cedb1e8b25057dab4826ec862f761bc176353adbd48781bcf130d6f3
Instruction Fuzzy Hash: 71018B32A161314BEF089F75D8140AEB3E3BFC820971A8969E8067B385CE34AC05C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8EB0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72410cb709ba82e9377191e953a20b758a3a550cd9a6245e0e74adf3b13f9a7
Instruction ID: 72a05936270537eb703287b157999ddc5d40c857a8d286a7fab24b8e39c9821f
Opcode Fuzzy Hash: f72410cb709ba82e9377191e953a20b758a3a550cd9a6245e0e74adf3b13f9a7
Instruction Fuzzy Hash: 1801D231B04208CBCB24FB68D8546EE7AB7EB88204F10046AD406EB391CF758C85DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 055E8AE1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07cc05be11218918c81a82923341a4741eeeb3139147b1fe99e4828c131abcf
Instruction ID: b60bddcffcac9534cce370ed11ee8f273b6c51712b53e70e7fe038fdef5a0021
Opcode Fuzzy Hash: b07cc05be11218918c81a82923341a4741eeeb3139147b1fe99e4828c131abcf
Instruction Fuzzy Hash: 1E118E71A10210EBDB195F24E8296AE7FB6FF89700F14845AF9029A290CF754D42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 055E8B0F Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629f828c0714499557f3b5782fd977e968b5476f1d6aa3b95d9bda26f8b56231
Instruction ID: 3cae2030041b868b4be07663f32a112dc3a8f87b355e074137faa2f1bb0ab143
Opcode Fuzzy Hash: 629f828c0714499557f3b5782fd977e968b5476f1d6aa3b95d9bda26f8b56231
Instruction Fuzzy Hash: D401D671A10204ABDB195F64D81D6EE7FB6EF8C310F108469F902A7380CE754E42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 051B5DFD Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d43497741a4130a705b7130e9119753b745947aafb13ab12424a837cb3d57ca
Instruction ID: 04cb8699f8584a0350dbf059acd2f9092310b3df47c31d0f7c59eea5aaf25e6e
Opcode Fuzzy Hash: 7d43497741a4130a705b7130e9119753b745947aafb13ab12424a837cb3d57ca
Instruction Fuzzy Hash: D9110435A10229CBEF25DB10C994BEEF372BB58704F164198C909AB284EBB15E849F91

Uniqueness

Uniqueness Score: -1.00%

Function 055E20B8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2286097cd73c4b3be2b76a960ae852656a1eaf975f4dd9b0f4082504262c9dbb
Instruction ID: ec5f538211bf15240974f977c9c8f90f7a11385dcdd3e630a9b6732fe0603bbc
Opcode Fuzzy Hash: 2286097cd73c4b3be2b76a960ae852656a1eaf975f4dd9b0f4082504262c9dbb
Instruction Fuzzy Hash: 1101ED357043145FC7299B30D944B7A3BA6ABC6220F048568D5168B2D1CBB5E802CB80

Uniqueness

Uniqueness Score: -1.00%

Function 055EDFE0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434f1ee220305a773b3eb7aa9e77870aa5f5168163e1716ed70152308cbca3d4
Instruction ID: 30cb3842a3a4178d35147297ae9d6bd31ad5d777f922960c5f48e4a64a75cb44
Opcode Fuzzy Hash: 434f1ee220305a773b3eb7aa9e77870aa5f5168163e1716ed70152308cbca3d4
Instruction Fuzzy Hash: 1601B174D5420FEFCF15DFA5E1425BDBBB5FB00300B106969D016DB240EE362A448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2501408840.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d7d000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86521e47190b96a76aa778035a439f28cd6e8566514fdecefceb0854a0ab546
Instruction ID: 84b49ad8697ab22fc24eef5ad4c2eed64fdbbfc0b96652408527e1940ea837eb
Opcode Fuzzy Hash: a86521e47190b96a76aa778035a439f28cd6e8566514fdecefceb0854a0ab546
Instruction Fuzzy Hash: DF01DB311083449AE7144A15DDC4767FFE9EF51364F1CC42AED4E4A196E279DC44C671

Uniqueness

Uniqueness Score: -1.00%

Function 05DE5DD3 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2f26efddad762d2a6c3e837afd5014ab5bd08b9bd230e4a35bde657a97674b
Instruction ID: aa03bc2639945211f90f0042bdc6bf709d8fa6351772ac02fc8f90da86568c02
Opcode Fuzzy Hash: bc2f26efddad762d2a6c3e837afd5014ab5bd08b9bd230e4a35bde657a97674b
Instruction Fuzzy Hash: B5018C70E05216DFCB15EFA4E85496DBBB2FF84794F10006AF442AB360DB748C00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055E20C8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4073399982d7d340948ff45ec7ec7a92811b47939b3af04f81def75f66e47d1c
Instruction ID: 00dd4c8870764f8eca1a50ab91054282f2efd172619a4b17dc5f5607f8e7e322
Opcode Fuzzy Hash: 4073399982d7d340948ff45ec7ec7a92811b47939b3af04f81def75f66e47d1c
Instruction Fuzzy Hash: 9201B1347007149FD7299B74D944A3A37A7FBC5310F148628D5168B7D4CBB5EC42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 055E8B20 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a8a3f2b1ddc15ceb9003459e251e7f3daab00697dc1611e4a9a717db7061e4
Instruction ID: ba6e731d4af465fec5c133ce205237f4a0e2422a610e815da4d6397b10cdd45f
Opcode Fuzzy Hash: 74a8a3f2b1ddc15ceb9003459e251e7f3daab00697dc1611e4a9a717db7061e4
Instruction Fuzzy Hash: 7D01B531A102149BDB185F55D81D5AFBFB6EF8C700F108469F902A7390CF754D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 051B50ED Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e909f4aceccaf310f6d27120c73f7f43bc7291178497121cef53a0b755f6393
Instruction ID: b5baa33480fc62c832ba75416d1345c08d68554f0408804a6c40d11bb80a78d9
Opcode Fuzzy Hash: 0e909f4aceccaf310f6d27120c73f7f43bc7291178497121cef53a0b755f6393
Instruction Fuzzy Hash: C7F02B76708342ABEB244B6D9C80BD6A7BBFFC2211F1B41BAD409D7157F7A24846C361

Uniqueness

Uniqueness Score: -1.00%

Function 055EEA9B Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f77244357927597a8e79b508aa3a84ead14d2ac4364cf788a50ab6cba63d7f
Instruction ID: 9b85a1055f3bafdec7969063e8db96bea53330f2f4b3f587d8e5a78ca371d189
Opcode Fuzzy Hash: 01f77244357927597a8e79b508aa3a84ead14d2ac4364cf788a50ab6cba63d7f
Instruction Fuzzy Hash: D2018C35A51606CFCB08CF64DD1A96D7BBAFF88305B004568E007D7360CB319901CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8E6B Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1696e4bc5f21a0f0b2f418ff7cd116db56234ede36b29675949978850635b810
Instruction ID: b055cd3c07088f2de1f4f6135701372c44676da763535a68fe3dd9d2ee9faeed
Opcode Fuzzy Hash: 1696e4bc5f21a0f0b2f418ff7cd116db56234ede36b29675949978850635b810
Instruction Fuzzy Hash: 62014B31711218CFCB19FBB4D55859C33B2FB98716B00086AD0469B3A4DE36DC52DB62

Uniqueness

Uniqueness Score: -1.00%

Function 055EB081 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d93af8dca1ec90f517e192b601b0c6b0988c2c27227815aae6b082cd01e22e
Instruction ID: 27ea34743c9b761c0d98bbed3598d386c639007bff9ae2613f0d40e31c365090
Opcode Fuzzy Hash: a4d93af8dca1ec90f517e192b601b0c6b0988c2c27227815aae6b082cd01e22e
Instruction Fuzzy Hash: 040186312082946FC706CF54DC518A67F79EF87620708C097FD448B252C672ED26CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055EEA61 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94ee8bacc82e5ceee1fc8ed7ef56f90cfa2bc5cdd1a8f0999124a8795f53e6c
Instruction ID: 5dc7e7447229086354dacd65af231511dc73d0ac82c56564ad94e1a607d48063
Opcode Fuzzy Hash: f94ee8bacc82e5ceee1fc8ed7ef56f90cfa2bc5cdd1a8f0999124a8795f53e6c
Instruction Fuzzy Hash: 13012931A56219CBDB288F64DD5A7ADBA76BB48305F004999E017E2790DB305941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 055E8F50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4028c20a58327e9b2251025b65bc945615e066dd5b6f0668b5cf972e88e10858
Instruction ID: a8ccf0a4c30dcca81de97f069b2da2a047a4f9cb3379dcd4883d098cd3a60ad2
Opcode Fuzzy Hash: 4028c20a58327e9b2251025b65bc945615e066dd5b6f0668b5cf972e88e10858
Instruction Fuzzy Hash: E7016D71E00A089FCB24DBA9D44869EFBF5FF48710F048159E4A993651D730AA81CB84

Uniqueness

Uniqueness Score: -1.00%

Function 055E2350 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4d4021828545b58c20b147ab5157251ecdb13c891776b284e534087b67f22d
Instruction ID: eb8b1ad90d6fa4ef2573cb1080dcc1c34cba0beaefbfea16c854bca463039970
Opcode Fuzzy Hash: 5a4d4021828545b58c20b147ab5157251ecdb13c891776b284e534087b67f22d
Instruction Fuzzy Hash: 69F02B713512285FD3099774D154B2A3BE6AF89300F0080A8E10A8F3D1CF7ADC43D781

Uniqueness

Uniqueness Score: -1.00%

Function 05D93999 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a57db4972722ef1cd1ccdeeaa7fb2d0ab4101278ffb2b23970f56e205e066a
Instruction ID: 6c3fc8d97fab527dfa66d3382a9294ffba897e6a550579d6cbff00abb749961f
Opcode Fuzzy Hash: f3a57db4972722ef1cd1ccdeeaa7fb2d0ab4101278ffb2b23970f56e205e066a
Instruction Fuzzy Hash: 5111F774945218CFDB55CF24D848A99BBB1FF89301F1044EAE80AAB361DF329D80CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2501408840.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d7d000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f888cd2fb71df13ab67307b11a9f26f2bd9ea5ce02021f3b8c2c40f2bd286548
Instruction ID: 85cfca94e99e2298a98e4aae82f2754daf3811209af1aeaa4a7a1ecb8c008924
Opcode Fuzzy Hash: f888cd2fb71df13ab67307b11a9f26f2bd9ea5ce02021f3b8c2c40f2bd286548
Instruction Fuzzy Hash: 53F09071408344AEE7148A1ADDC4B62FFA8EF51734F1CC45AED4D4F296D2799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 055E2360 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ad1b8873631bdf402dc3fbe69c4e0fc410999d5e7512c81274a11cc13ee7dd
Instruction ID: 6b4e0221e765129689458b113343eb2ed06b49014943d6e1651b3e0bfe690eaa
Opcode Fuzzy Hash: c7ad1b8873631bdf402dc3fbe69c4e0fc410999d5e7512c81274a11cc13ee7dd
Instruction Fuzzy Hash: F6F06D303002289FC71DAB34D158A2E37E6AB8A704F104468D1068F7E0CE76DC42CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 05DE5D80 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45857cebbf1d3961c1eab9e1e98ad9fdbed852b578055de02a3ca8c65a7b134f
Instruction ID: 27d21f3cfd2cdbbcdee2e545f77580093ecf69d824f67da20c5409887f784020
Opcode Fuzzy Hash: 45857cebbf1d3961c1eab9e1e98ad9fdbed852b578055de02a3ca8c65a7b134f
Instruction Fuzzy Hash: 9EF06531701204DFDB15E779EC4896F7BE7EF842A4B408476E646C7394EF21D9028692

Uniqueness

Uniqueness Score: -1.00%

Function 055EE070 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8a59a966bb8f519ed523050db25a6f9bf7f737245f98d6acd8ab89284b150c
Instruction ID: 158ae576223b0a6cf80884a9f5fefb535702bf2fdc70144fe26b208743ce36fd
Opcode Fuzzy Hash: fc8a59a966bb8f519ed523050db25a6f9bf7f737245f98d6acd8ab89284b150c
Instruction Fuzzy Hash: B5F0E533624214AFCB0597A8F4177DA7FECEB88171F1440A6E00DC3681DD3294428394

Uniqueness

Uniqueness Score: -1.00%

Function 057E11B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3662cb5847ab3ba1bdd1a6256b1a6c3364adf80f174583c4ba2495d408497c8d
Instruction ID: d8fa6ff2710cc6f42b71fbb422b60553be9d636cc116dba355e522086fe58a05
Opcode Fuzzy Hash: 3662cb5847ab3ba1bdd1a6256b1a6c3364adf80f174583c4ba2495d408497c8d
Instruction Fuzzy Hash: 18010C74A04619CFD758EF14D855B9A7BB1FB88301F1080A5E40DA7344DA746E80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05D94841 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8943a55c470f621fc4df89f5e124b4f02a979697671fab0a755713f2d368a40
Instruction ID: 60ff145aff8fe666d4fd2c5a42aee4e6647f1dcff848a3baf363d5c5677f5bc6
Opcode Fuzzy Hash: a8943a55c470f621fc4df89f5e124b4f02a979697671fab0a755713f2d368a40
Instruction Fuzzy Hash: A201A474605600CFD758DF39C4989597BF2AF49305B6544A9E40ADB772DB32DC41CF05

Uniqueness

Uniqueness Score: -1.00%

Function 057E55C8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0fd06ba585563eadc4f662147c1a4f828fb3b13a8776c1a25d738f277113fb
Instruction ID: 09628e3308d9ef645452c868cc4d4a536bc8be7d33ad6f6b2cbbad7e1f8a020b
Opcode Fuzzy Hash: 3d0fd06ba585563eadc4f662147c1a4f828fb3b13a8776c1a25d738f277113fb
Instruction Fuzzy Hash: EA01E978A04618CFC759EF28CC9479EBBB2EB88309F1040E5A80DA7344DB749EC48F60

Uniqueness

Uniqueness Score: -1.00%

Function 057E11BE Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4482c59db7cb770f4fb4afca6732f3292f85e09d870c7d6e94af226ded742ac2
Instruction ID: db27723f2ab6112e1d40e3e191351d1aad341a24dfb3b1e5066b204c8e108929
Opcode Fuzzy Hash: 4482c59db7cb770f4fb4afca6732f3292f85e09d870c7d6e94af226ded742ac2
Instruction Fuzzy Hash: 6A01D774A08718CFD759EF68D884B9ABBB1EB88301F1080E5E40DA3344DA74AE808F61

Uniqueness

Uniqueness Score: -1.00%

Function 055ED2C2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea66bb53a59d986ac45084de1cd810a9bd59ee24f97a9173ab16e574c818db0
Instruction ID: f8efc156e1cd9730ce9ca2b79f05db022f6d80dc661fd445bacb582350938417
Opcode Fuzzy Hash: 6ea66bb53a59d986ac45084de1cd810a9bd59ee24f97a9173ab16e574c818db0
Instruction Fuzzy Hash: 8AE0123111C2855FD34797A4E853B21BB79EB86614F58C49DE94C8B243CA22E803C7C9

Uniqueness

Uniqueness Score: -1.00%

Function 055EF2B0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a1aa9fafd5b9e51ed57e639a9674e367eea7a43fec1467ca37bd33b8078a65
Instruction ID: d0b41c7896834dc11de8a4bae343575091b4c852e413adaeb952f42073d61571
Opcode Fuzzy Hash: f4a1aa9fafd5b9e51ed57e639a9674e367eea7a43fec1467ca37bd33b8078a65
Instruction Fuzzy Hash: 68F0E9769092889FCB09CFF49D5197A3FB5BE0521071488BFE44AC7102EF310E05D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 055EC863 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f881879b4b887134b8a3a7dedba5e79bd9ad8adbcf740b57c7492fc5ed01a3
Instruction ID: c63689d9b8b72d46912178006ec7602574dfd96d41f53944a02de1cce6bf7fc8
Opcode Fuzzy Hash: 50f881879b4b887134b8a3a7dedba5e79bd9ad8adbcf740b57c7492fc5ed01a3
Instruction Fuzzy Hash: 90F09032B08210CFD71CDA26D549B7633A3FB86311F14C064E405E7358CA30DCC19B94

Uniqueness

Uniqueness Score: -1.00%

Function 057E610C Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fba4e19ed31a9e9e7cee995c8ea19c96fbbc85fdf67d0138b2b22b58376d1ef
Instruction ID: aa21e1bc1afc129f5c581fce556e8c4f719461d46a3487bc210ecd7d7e4bfada
Opcode Fuzzy Hash: 3fba4e19ed31a9e9e7cee995c8ea19c96fbbc85fdf67d0138b2b22b58376d1ef
Instruction Fuzzy Hash: 4D01C434A04258CFD754EF59D858A9EBBB2EB88304F1080A6E419A7394DB70AEC1CF61

Uniqueness

Uniqueness Score: -1.00%

Function 057F68C0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e91b7ab91f0a58d1ccb82fc0290e5ee53a82ceeec3434d55026fcda76df632
Instruction ID: b1dca73964172c0c863a8006d1e6c91ea928b4ceb407b3c39dd408253f83534c
Opcode Fuzzy Hash: 91e91b7ab91f0a58d1ccb82fc0290e5ee53a82ceeec3434d55026fcda76df632
Instruction Fuzzy Hash: 68E01A217003286BD3082A7E5C55B6BAA8EEBC5B60F24842EB50DDB396DC668C4513F5

Uniqueness

Uniqueness Score: -1.00%

Function 05DE5D71 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6395bc371ceed26b1cd56f077cb64e5d83f21121e533501406867a0ec08542
Instruction ID: 9bac3655190464760576d09f0498662aca769f151afe586bbd74a5b19b2d87d5
Opcode Fuzzy Hash: ee6395bc371ceed26b1cd56f077cb64e5d83f21121e533501406867a0ec08542
Instruction Fuzzy Hash: D7F0E574610304DBCB11A774DE5DA3F3BE6BF452A5B41446AD582C33A9EF64C8038792

Uniqueness

Uniqueness Score: -1.00%

Function 05DE18F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ddf16243163d6704ffcb2125569ddce922eb89344c1e7b84721b495edacfe8
Instruction ID: fba8020e6bff2332435f3786231ae60298f33d3e4e510810b03f4c620c6d7862
Opcode Fuzzy Hash: 85ddf16243163d6704ffcb2125569ddce922eb89344c1e7b84721b495edacfe8
Instruction Fuzzy Hash: 5EF01D396102048FC745EB38E459A2D7BF2EF8C301F418096F44AD7390EE318D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 055E050D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3d99749761277e3ce5bfc8200b4d9cded59b2a2fdcbd2c2bd631b3036ca790
Instruction ID: 9da0bcf859e4294835717aac498e76e3a98f9095670385beda562da7234004e7
Opcode Fuzzy Hash: 3e3d99749761277e3ce5bfc8200b4d9cded59b2a2fdcbd2c2bd631b3036ca790
Instruction Fuzzy Hash: E8F0A739E00209CFCB089FA4E4494ADFBB1FF45311B10886EE94767260DF319899CF90

Uniqueness

Uniqueness Score: -1.00%

Function 055E81D9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5311a7cf4cb8d2de89d333a204aa27a49b19b48398b0e922357ed89c30c16294
Instruction ID: d6189822b452eb5b5759bb56ba8896b79a24a70d0fc0fade86f05369a790bdf0
Opcode Fuzzy Hash: 5311a7cf4cb8d2de89d333a204aa27a49b19b48398b0e922357ed89c30c16294
Instruction Fuzzy Hash: 85E08676604108AFC705CBE4EC92AA5FBB5EF95204F1081EAE95987361EE32AD12D790

Uniqueness

Uniqueness Score: -1.00%

Function 055EF261 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e4a26ff5f8a0cb2ebba8fd300a962855d9d302e966e79deaa925ec1f52d25c
Instruction ID: f32ef91e6953955e5bd82ccf5f635a84b1cb812c90aa70b9b814fcd3687a3808
Opcode Fuzzy Hash: c9e4a26ff5f8a0cb2ebba8fd300a962855d9d302e966e79deaa925ec1f52d25c
Instruction Fuzzy Hash: 16E01A75909108EB870CDFE099414AA7BAABE4430472489AAA40B97600EF314A01E7A4

Uniqueness

Uniqueness Score: -1.00%

Function 055E9B40 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ad5091832ed340f14a6832f9c5fb31005abb07b0e6fa7f0ed9135e301a2b42
Instruction ID: 67eafa31c432539de9801eec08e7eb4af253981638aa2fb51dc4a26707193b15
Opcode Fuzzy Hash: 62ad5091832ed340f14a6832f9c5fb31005abb07b0e6fa7f0ed9135e301a2b42
Instruction Fuzzy Hash: 5AE01A35204A009FC324CA1AD944F13F3FDFFC9A20F55956EE58A87A61D670F8018B54

Uniqueness

Uniqueness Score: -1.00%

Function 055E87B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3177584c529578dab558cf8631493c30a5e075ba792614090da174131c2254
Instruction ID: c6f1ac2bce40b75b624bc62e1fa81b1d5edad0e9e7a17d74a55c6868b1f92b36
Opcode Fuzzy Hash: 5d3177584c529578dab558cf8631493c30a5e075ba792614090da174131c2254
Instruction Fuzzy Hash: C6E04F72110189BFCB018FC4DC02DE67F2AEB99260F08844AFD4446211CA72D923DB90

Uniqueness

Uniqueness Score: -1.00%

Function 055EA2DD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39a73f89b4511804c198c8a3ee51871467b6f2fb3e9572290b1ff250969d8f8
Instruction ID: 201aa349094eef94d006c66f3bfa795b879ef8fcde04f122767f4c1cab76f67f
Opcode Fuzzy Hash: e39a73f89b4511804c198c8a3ee51871467b6f2fb3e9572290b1ff250969d8f8
Instruction Fuzzy Hash: DAF0AC35B04204CFC749EF69E45969A7BB2FF88354F248125E415A7398DF749C818BA1

Uniqueness

Uniqueness Score: -1.00%

Function 051B56B6 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a58d0bc0aa87a61e369baa5a660f17c43113cae646de3eba7b07d69f8784fdb
Instruction ID: dbba2f52e3adfa780319c7821128126bed88ffe320bc113748de9f91b0e99c14
Opcode Fuzzy Hash: 3a58d0bc0aa87a61e369baa5a660f17c43113cae646de3eba7b07d69f8784fdb
Instruction Fuzzy Hash: A0E0C239B04255CBEB28DB05C580BE9B7B3BB84224F57C095D90AAB210FBB0AD408B81

Uniqueness

Uniqueness Score: -1.00%

Function 05DE456D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcc9e4f8271ec22bb3b5de62989630f6d0c792288f1d38c427ded2c37391961
Instruction ID: 80ec7b851a8346d5cc9e2dada8ff99037a2c46b84018589eb0f6719e3c17c8da
Opcode Fuzzy Hash: 0dcc9e4f8271ec22bb3b5de62989630f6d0c792288f1d38c427ded2c37391961
Instruction Fuzzy Hash: DDE01AB5D0838DDFCF01EB64D855A6CBBB2BF0A200F11429BC4866B261C7349849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8CA9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a616b6a3517f10752f23d42ecdb3bfec983d202060fd91b29cbbb26a9e535cb0
Instruction ID: 50b842232dc392d491a7976d8d4af6b473a3ae525764c48158e230ac7e62d911
Opcode Fuzzy Hash: a616b6a3517f10752f23d42ecdb3bfec983d202060fd91b29cbbb26a9e535cb0
Instruction Fuzzy Hash: BFE0EC70C1960E9F8F50FFA9464057E7BB1BA06244B1119A7C499E2304F6718551AB92

Uniqueness

Uniqueness Score: -1.00%

Function 055E8398 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7853cfbc7441998808973aa2f1714b281419eca9cad722dc2dee0979792c41c
Instruction ID: 3a17d02d24a36af62f9ef5718ef978202fcef85cc778377deedfe843486424e3
Opcode Fuzzy Hash: e7853cfbc7441998808973aa2f1714b281419eca9cad722dc2dee0979792c41c
Instruction Fuzzy Hash: CED0C2722101142FC3018684DC439A5BF69DB89120B04C046ADC447302C972ED0387C0

Uniqueness

Uniqueness Score: -1.00%

Function 055ECDFF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a74191da441bc47d9422e11dbb9b1aebddfb6fd56dda7fdf0b044c629cdc3b7
Instruction ID: 14e3729eba04180245f583a13c49f182d4f6933eee0d81eaf3ffbe7e62348f90
Opcode Fuzzy Hash: 5a74191da441bc47d9422e11dbb9b1aebddfb6fd56dda7fdf0b044c629cdc3b7
Instruction Fuzzy Hash: 83E0863070C200CBD70DDA19D8597363297FBC8345F188475F0058A648CE74CCE54BA1

Uniqueness

Uniqueness Score: -1.00%

Function 057FBED0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452dc4ba3f9cde2ee0d8cf928ff389c95de47e577554c5ac359cd146542074de
Instruction ID: 3dda1b35caa8fe4b6c2571b97fc0e11c40a73a4f45eaae821332304d763a4f83
Opcode Fuzzy Hash: 452dc4ba3f9cde2ee0d8cf928ff389c95de47e577554c5ac359cd146542074de
Instruction Fuzzy Hash: 6ED01732A1520DEBCB10DEB5D9024AABBECEB06205B1006E9AD0DC3200EE32DE119792

Uniqueness

Uniqueness Score: -1.00%

Function 05D9ACE0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9065971be0e664df2760bbc6490d5b13ce884d5f8ec10a7cedd6d8d39ab84c
Instruction ID: c77782993a4f662478a102c53f598aa5f5d211c2fb2997e069b5fd3399bb6192
Opcode Fuzzy Hash: 4e9065971be0e664df2760bbc6490d5b13ce884d5f8ec10a7cedd6d8d39ab84c
Instruction Fuzzy Hash: 0AE0CD30A1431CAFDB185A14DC147677B7AEBC6310F01407B544A63380DE705D448BD1

Uniqueness

Uniqueness Score: -1.00%

Function 05DEC690 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b04dc8dbc4d3fc8ba4869fee4eba2e7de64001f9c1558d77f549c29ad744e4
Instruction ID: 788117c39f5d5584b5246bed654425ce4efb6961df3d6a082496eefdee7ac8dc
Opcode Fuzzy Hash: b7b04dc8dbc4d3fc8ba4869fee4eba2e7de64001f9c1558d77f549c29ad744e4
Instruction Fuzzy Hash: ADD01275C0020D9F8B40FFBD9846299BEF4E604211F54056BA848E3300F63896118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE896D Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f313f5423a8a07d4ff287d30c18f88df7141a8e4d0cdf09abd80f1110c15acae
Instruction ID: 55cc81da42e26f9110b31198e0a227b7ea015cff5bad99c87bef0f0edbbfe937
Opcode Fuzzy Hash: f313f5423a8a07d4ff287d30c18f88df7141a8e4d0cdf09abd80f1110c15acae
Instruction Fuzzy Hash: 99E026B1A06108DFCB11DF74F644598BFB2FB00362F1002D2E0958B012CB30AD468B80

Uniqueness

Uniqueness Score: -1.00%

Function 055E7188 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b6890cab0f52588bd8684159f246d99dcd3c7dab75e450a5db4d2ddc8f1800
Instruction ID: 77eeb08db82785cd662b949ddea4228ed98e09697b49452000300f43b9906f5d
Opcode Fuzzy Hash: 87b6890cab0f52588bd8684159f246d99dcd3c7dab75e450a5db4d2ddc8f1800
Instruction Fuzzy Hash: 84E0C22285518CABCB01DBF09D021DE7FF9DB45200F0048E1A44487211EC3A8A01A784

Uniqueness

Uniqueness Score: -1.00%

Function 055EBDD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae3cfe94dd0185ef93466047604e400b858ac6fcc1acf8b4fabf5b637f8add4
Instruction ID: 4014d08b902d9568875b990ac9528cfa77df2057cda2b01d272c8b9bff9f16f5
Opcode Fuzzy Hash: dae3cfe94dd0185ef93466047604e400b858ac6fcc1acf8b4fabf5b637f8add4
Instruction Fuzzy Hash: C6E08661D4934C6FC701DBF04D1145E7FB89F0720070504E695019F162E8355904A395

Uniqueness

Uniqueness Score: -1.00%

Function 055E6E83 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905d230944f325970a6acc6161f9817b7a65739901fad54e3b234bf4281b94a6
Instruction ID: 93df96476582c621752258124bd0a537f686214ee6af1323de6ad3b273d0d921
Opcode Fuzzy Hash: 905d230944f325970a6acc6161f9817b7a65739901fad54e3b234bf4281b94a6
Instruction Fuzzy Hash: FAD0A9320082400FC3028B94DC42B40BB34CB86218F1880DAD808CB243D626E912838E

Uniqueness

Uniqueness Score: -1.00%

Function 05D95BCB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b916da1eba4ac087c101a8898ed1fc006bf2b691d7e29b00dcdb46019bfe322c
Instruction ID: 6236dea0a707705c43af1d5575686ef1d53fa5c3b118a918a0d99464101693c2
Opcode Fuzzy Hash: b916da1eba4ac087c101a8898ed1fc006bf2b691d7e29b00dcdb46019bfe322c
Instruction Fuzzy Hash: AFF015749492158FEB94CF28CC99A88BBB1FF48324F1442C9D81D973A2CA31AD80CF41

Uniqueness

Uniqueness Score: -1.00%

Function 055EC802 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99180dcd36bd8a68e9bbd35572655307d280f80bdf377b5503d43c1f76fce58
Instruction ID: 5c3ccdb4becb8daa2e90e17a8867cf228451a7b509c97270b380a626bf15dfd8
Opcode Fuzzy Hash: b99180dcd36bd8a68e9bbd35572655307d280f80bdf377b5503d43c1f76fce58
Instruction Fuzzy Hash: 3FE0C23260C080DED31EC764F1127647F63F386200F0888A5F14987205CE31EC428294

Uniqueness

Uniqueness Score: -1.00%

Function 055EAA20 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd73ba3e333085e63d22eed1ba42ed917446b75f95bc9f2a428449561e96fddc
Instruction ID: 6f6bb013d0453faa8a67667745483534711aca4da29b0ca593d2cda3b303d3ab
Opcode Fuzzy Hash: dd73ba3e333085e63d22eed1ba42ed917446b75f95bc9f2a428449561e96fddc
Instruction Fuzzy Hash: E3D05E363141441BD300C698E852AAABBA8DBCD130B14846AE58887202D922A8038A90

Uniqueness

Uniqueness Score: -1.00%

Function 051B5757 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985dc8b434edb674436ba2f5d964100bd06185be5fba671075e55d7b3985e2ba
Instruction ID: 67846ea1c595d79fe96885e1f8be4e3623f0951cac9fa3dbf3c6d0c1cc73d389
Opcode Fuzzy Hash: 985dc8b434edb674436ba2f5d964100bd06185be5fba671075e55d7b3985e2ba
Instruction Fuzzy Hash: 6CE0EC39F04255CBEB34DF45D580BE9B773BB44224F4780D5D90567200F7B09D408B91

Uniqueness

Uniqueness Score: -1.00%

Function 05D91B61 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c7e456f2deaf98ab6fe23dc23fca0cbfd3e1fdeff3d9858e5f1668d18ddf4b
Instruction ID: 1a09b91326c52ed1a408468251c346c9fdd2ea2ca79a999b5b2911e6917b9c15
Opcode Fuzzy Hash: 69c7e456f2deaf98ab6fe23dc23fca0cbfd3e1fdeff3d9858e5f1668d18ddf4b
Instruction Fuzzy Hash: 5AE01271D1D246DFDB09CFA4EE455697BB3AB92256B10C5EBC04A97011F6304A04DA10

Uniqueness

Uniqueness Score: -1.00%

Function 05D91B70 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72be95fd0b3988f5446b13f1798acd36742670698759b07e63c7225bc4dce165
Instruction ID: 2e1becf48d2662aff1e4aacaa676cccb6fae9e7ab493928d3c47348118ff5f2d
Opcode Fuzzy Hash: 72be95fd0b3988f5446b13f1798acd36742670698759b07e63c7225bc4dce165
Instruction Fuzzy Hash: 8BD0A73080820EEB8B08CED59D41469B7BB9AC1255B10C1E2D40A93100FA308E00C650

Uniqueness

Uniqueness Score: -1.00%

Function 055E8170 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b81a8eaf999f946651a45d440fda23fe9fee4b607390eca7c580c806dc87d3a
Instruction ID: ac9ccc1b8d5f0477d6e6b28a845d8d09e7158668094e8fd32b1eb981590d7693
Opcode Fuzzy Hash: 4b81a8eaf999f946651a45d440fda23fe9fee4b607390eca7c580c806dc87d3a
Instruction Fuzzy Hash: 45D0A7B23242C41FC340C768D853A62FBA4DF98100F04C459E4488B301D921FE03CA44

Uniqueness

Uniqueness Score: -1.00%

Function 055E7198 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92872b87d093f3aa065665c131e74adff7851995231078833edc961d49b3cf30
Instruction ID: 8b46ca0c7dbaf4a1a569f5fc2bc95afb4e46d57ba508df659c71a0fb916fe3a5
Opcode Fuzzy Hash: 92872b87d093f3aa065665c131e74adff7851995231078833edc961d49b3cf30
Instruction Fuzzy Hash: 54D0523180220CABCB00EFA4890149EBBFAAB45200B0008A6A8089B221E9368A00AB91

Uniqueness

Uniqueness Score: -1.00%

Function 055EB020 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01121f2c778aaa955698064ff843d2996bee34fc2f5530b77e7ea5e79a423cb0
Instruction ID: 1b0a6f6d896694a697788613f5e5355b62e48349d74697ae87246d03dd23ea49
Opcode Fuzzy Hash: 01121f2c778aaa955698064ff843d2996bee34fc2f5530b77e7ea5e79a423cb0
Instruction Fuzzy Hash: 05D0C936200118BF9B04DE88DC41CAABB6EEB89660714C05FFD1887311CAB3ED22DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 055EF290 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc116b6eaa5cadfda196dc68421556c10aac1cd9b7936e748fa46d698ffb8c1
Instruction ID: d826d083899bafee484b318e3f54477b4e47e3ae9b1613c33f4c93f27eeb7c65
Opcode Fuzzy Hash: ecc116b6eaa5cadfda196dc68421556c10aac1cd9b7936e748fa46d698ffb8c1
Instruction Fuzzy Hash: BFD012B942E7C44FCB130FE86D954653FB07D1613538544A3E048D6053EB600955C7E9

Uniqueness

Uniqueness Score: -1.00%

Function 055EBDE0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d256cc3352379199f5d095d08e80344aa71b1953fe21ada31469d1f05729414d
Instruction ID: feaf52f6c5f027dd991cde6f05b94b9d4a2ae66941c1ed2467d7ea30aab75d7e
Opcode Fuzzy Hash: d256cc3352379199f5d095d08e80344aa71b1953fe21ada31469d1f05729414d
Instruction Fuzzy Hash: C4D0927194620CABCB00EFE589414AEBBEDAF45200B5045AAA9059B261E9769A10A791

Uniqueness

Uniqueness Score: -1.00%

Function 055E9C30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbeb08dadf14bb9402f02c1834f8cc4048ca33be99f1d01eb37240872e5529e8
Instruction ID: 5f4d6b67a1590e3310ee183bfb30570e7a0d3037b95b30f36083308200122dc5
Opcode Fuzzy Hash: cbeb08dadf14bb9402f02c1834f8cc4048ca33be99f1d01eb37240872e5529e8
Instruction Fuzzy Hash: 41D0A7712141441FE700C758E853AA1FBF4DB99610F14C059F48883341DD21EE03C250

Uniqueness

Uniqueness Score: -1.00%

Function 057FA168 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07509b8ab377388623f533b321e3150734b7451809f3ef39b1e503a0f4953f6b
Instruction ID: 13a7a9c56052df19f64ea02714a9d952570fcdc95e20d42b236b0d99e5b7619d
Opcode Fuzzy Hash: 07509b8ab377388623f533b321e3150734b7451809f3ef39b1e503a0f4953f6b
Instruction Fuzzy Hash: 9BD0927194520CABCB01EFE58A0249EBBA9AB45200B5045EAA505AB261EA3A9A10A791

Uniqueness

Uniqueness Score: -1.00%

Function 057F4530 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54b4754e35c00f34872614f325cef40c0ec8824635acad50210c860c5fdd951
Instruction ID: cee5fd3b75f76a9434ad3188079970b28fb5fe8db2e4985f56238af3eba8a030
Opcode Fuzzy Hash: f54b4754e35c00f34872614f325cef40c0ec8824635acad50210c860c5fdd951
Instruction Fuzzy Hash: 00D09E71D4510CABCB01EFA5890145EBBA99B45200B5049E6950597151E9369E106791

Uniqueness

Uniqueness Score: -1.00%

Function 05DE8CB8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a0d1dfa72af3760fd0f6bac8e603471da8d1c2a81f45c5a94cf52873bd811a
Instruction ID: a709dab1005f484b8a61d5e8eb17822631dfdd5a171b869abc5e44d4c0331ff4
Opcode Fuzzy Hash: b7a0d1dfa72af3760fd0f6bac8e603471da8d1c2a81f45c5a94cf52873bd811a
Instruction Fuzzy Hash: 25D0C770C0520D9F4B40FFB9490517FBBF4FA05100F1145A6C459E2300F77446109BD1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7A76 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2f300b80de0897a1ce8e58119dfb22088efbfd175c595c0aa7862abbb099e7
Instruction ID: aa7dadf7775fa9ffcace4d1fa2521eeeb8cbb4f416fd2cf2ccb94ab8f27be695
Opcode Fuzzy Hash: ac2f300b80de0897a1ce8e58119dfb22088efbfd175c595c0aa7862abbb099e7
Instruction Fuzzy Hash: 2BD0A733904085C9C754E6D8A4462DCB735EB40238F080243E32B520C1C730C6548252

Uniqueness

Uniqueness Score: -1.00%

Function 055ED260 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60aa586e249a63ffe810e3b6af46a9b58f23c3c8aad57b9106511b830a45201b
Instruction ID: f04a75eccf214632db6d7ad1f7ddf04152dbe8a2531d048b6973974ea250379d
Opcode Fuzzy Hash: 60aa586e249a63ffe810e3b6af46a9b58f23c3c8aad57b9106511b830a45201b
Instruction Fuzzy Hash: B3D012311141144FC7439A54D883B02B3A4EF41604F94C09DEA088F201DA32D402C5CA

Uniqueness

Uniqueness Score: -1.00%

Function 055E72D0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b0d9234bb66c1188f1d8ffa40f5dfc53d4c1c36c7dc96e40cd36b14f4496b2
Instruction ID: 54866b36ea15afb65e7a875d6165a5cb79d68b9b9f7e81275e0a8b5c21ccf77f
Opcode Fuzzy Hash: 90b0d9234bb66c1188f1d8ffa40f5dfc53d4c1c36c7dc96e40cd36b14f4496b2
Instruction Fuzzy Hash: AAD012727181486BD705C39CE892760BBD9DFDD104F18C4A8E44CC3352D912ED438345

Uniqueness

Uniqueness Score: -1.00%

Function 055E7DC0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7a7932f7e30d2b358ae70023f2b8d09c125e5bc6cf012d5a61b1ff510dcaf7
Instruction ID: d05b181caef38dd0f8205310c2cd0bbd6106777f6c892e349b3dbdfce5356238
Opcode Fuzzy Hash: 6b7a7932f7e30d2b358ae70023f2b8d09c125e5bc6cf012d5a61b1ff510dcaf7
Instruction Fuzzy Hash: E2C080335443085BC3009548DCC1704B355C77D308F84C068D80CC7305D92ADF43428C

Uniqueness

Uniqueness Score: -1.00%

Function 055ECFF0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86648ebdbe662cbfc2c994b9b05bd4574351220bc9c34b77caffc515a08aaa9
Instruction ID: 7b674761c68c410bed331807ef571c268872767c4949ba3ae399b35fbf3c8f1a
Opcode Fuzzy Hash: f86648ebdbe662cbfc2c994b9b05bd4574351220bc9c34b77caffc515a08aaa9
Instruction Fuzzy Hash: 08D05E752082815FC342CA68C955A627BB1AF86308F28C0BEA80DCF262D637D807C751

Uniqueness

Uniqueness Score: -1.00%

Function 055ECF8A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd239658e392202f5e9a7fc7ae3f33f5497f0cae33feb4b896209b0aaa057ddf
Instruction ID: babc7f7fe345044d4b30b5fbee22d3e261f331141bcdcf377745c1330b783bd9
Opcode Fuzzy Hash: dd239658e392202f5e9a7fc7ae3f33f5497f0cae33feb4b896209b0aaa057ddf
Instruction Fuzzy Hash: B9D0A7322042441FC305C758C851B12BBA9DBD9514F48C06DE849C7301D531EC12C140

Uniqueness

Uniqueness Score: -1.00%

Function 05D93D52 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69e5a5bb16492e08b4b8ec10e12302c3470aa5fea002480262b66ae2f325a70
Instruction ID: 18307c172c047c2c81c2e2a08a20bf8ea5121dc23dd868edd0cca9c984442378
Opcode Fuzzy Hash: d69e5a5bb16492e08b4b8ec10e12302c3470aa5fea002480262b66ae2f325a70
Instruction Fuzzy Hash: 0BE026B8A00214CFDB54DF28C884A99B7B2BF9D301F5141D9E559A7361DB31AD81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 05D93C83 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4c991408a655890f9a383948a05a8b2eaab9dd0a201859929b740a15a6ce6e
Instruction ID: e57e8bbc4366269d3d369183c1cc5d04ecb5f10ddf948a3d1f10897d9907a36d
Opcode Fuzzy Hash: be4c991408a655890f9a383948a05a8b2eaab9dd0a201859929b740a15a6ce6e
Instruction Fuzzy Hash: AFC01236B0D1048FCB049798F8545DCBB31DB95215F0080A3D556B3581863259158A51

Uniqueness

Uniqueness Score: -1.00%

Function 05DEC6A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a77e926e3b684a6a27a215beebafad6068e415c4c5139ce266f226da1a90d52
Instruction ID: f5b1da808e050c2264302b5bb633dea26f736827b3c1de9e963854648eca540f
Opcode Fuzzy Hash: 8a77e926e3b684a6a27a215beebafad6068e415c4c5139ce266f226da1a90d52
Instruction Fuzzy Hash: C4D0C9B0C1420C9F8B80FFBC980626EBFF4FA04200F0045ABE809E3210FB308A108B92

Uniqueness

Uniqueness Score: -1.00%

Function 05DE61F0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483a403b968bf0691f8041e2839d84f29fd915bdff0f2fe8469f1b50ff4f4b29
Instruction ID: ffdc9d64ae0ed93bb4c4a678b2f0d0ae580f16aeca32ca7c7573748d5e4de82e
Opcode Fuzzy Hash: 483a403b968bf0691f8041e2839d84f29fd915bdff0f2fe8469f1b50ff4f4b29
Instruction Fuzzy Hash: 13C04C3125920946EE51B6B57C49B3B369FAB60754B040477B44DC5942E946D4519045

Uniqueness

Uniqueness Score: -1.00%

Function 055E6F70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4575201db7f7d1caa06bc605423881403aa2e97686d24c77bee076518a6150e
Instruction ID: 57d5fc504d7a962ab355f8ab39eb25fc53c5f705ef109e30aa15e52f5248e19c
Opcode Fuzzy Hash: f4575201db7f7d1caa06bc605423881403aa2e97686d24c77bee076518a6150e
Instruction Fuzzy Hash: 3ED012365580449FD600C6D8D843750BB69DB59208F58C5A9E50887241CA23A5538780

Uniqueness

Uniqueness Score: -1.00%

Function 055E6E90 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c22af0b04de43b2f573eb555c0846f6aed5326bc0496607d1475586ddb3fcc
Instruction ID: 32b997c399ba80a2414d96cca15de6688b88bf971bb598de14c59db6e8089be8
Opcode Fuzzy Hash: 96c22af0b04de43b2f573eb555c0846f6aed5326bc0496607d1475586ddb3fcc
Instruction Fuzzy Hash: 30D012365044044BC711DB48DD53750F365DB49618F5888A9D9188BB01D736F672C5C9

Uniqueness

Uniqueness Score: -1.00%

Function 055ED000 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction ID: 58c7e918dc9fc6e739d0296992eb27fcb8a7bf4254ad48f247067e0340e6a738
Opcode Fuzzy Hash: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction Fuzzy Hash: A6C012313402095BD304CA88C842A22B3AADBC8614B14C079A808C7746DE36EC028694

Uniqueness

Uniqueness Score: -1.00%

Function 055E1C30 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: defb615a246f678d25aa856a77979015b032fd89f2db08c1538225fe6ac85fca
Instruction ID: 8cf7d088c0568584faf3c42a5e0f9764cae1e3bf6a522e5908b1cf2cf482d1e2
Opcode Fuzzy Hash: defb615a246f678d25aa856a77979015b032fd89f2db08c1538225fe6ac85fca
Instruction Fuzzy Hash: 78D0C9763582589FC702DB64E804E407F78AF19220F488195F94546262C7629814DB91

Uniqueness

Uniqueness Score: -1.00%

Function 055EE99D Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c7a7d6b10414d7dfa6c8cf49fda5db924195a06186bb4f1866fb0038767b19
Instruction ID: c1954ad31fcc34048765d0603e77ceb83dea6c20687c5114bec04fcff6ce1214
Opcode Fuzzy Hash: 27c7a7d6b10414d7dfa6c8cf49fda5db924195a06186bb4f1866fb0038767b19
Instruction Fuzzy Hash: 04D06731C15119DFDB18CF78D586B9DBBF6BF08345F1595A5E01AEB211E3305A408F50

Uniqueness

Uniqueness Score: -1.00%

Function 055E7BE1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7b77d89acaf092e78d356c4e1874c0e6ac2dadcfdc9f775edbc093dc45abff
Instruction ID: e3b20e85b9e5b7542ae8b094b2e070a66716d8206fa636f8b2922b1b3047e837
Opcode Fuzzy Hash: ba7b77d89acaf092e78d356c4e1874c0e6ac2dadcfdc9f775edbc093dc45abff
Instruction Fuzzy Hash: 81D012316082894AD70297A8E552750FF688F86208F4884ECE98D8B243DA22A403C684

Uniqueness

Uniqueness Score: -1.00%

Function 057F7250 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction ID: 58c7e918dc9fc6e739d0296992eb27fcb8a7bf4254ad48f247067e0340e6a738
Opcode Fuzzy Hash: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction Fuzzy Hash: A6C012313402095BD304CA88C842A22B3AADBC8614B14C079A808C7746DE36EC028694

Uniqueness

Uniqueness Score: -1.00%

Function 051B57F6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2587088009.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c533359947a8e2b2f80c5bc84dbaef60392404cd01e3e8b6cc3414158e3accd
Instruction ID: 196f4f8d1d7a2777f8853a4cef2d323c366191dce217163640ac2822b08f3781
Opcode Fuzzy Hash: 9c533359947a8e2b2f80c5bc84dbaef60392404cd01e3e8b6cc3414158e3accd
Instruction Fuzzy Hash: FFD0C936E00264CBDB34EB4594407E8B763BB44221F434096CA0667100A7B09A544B91

Uniqueness

Uniqueness Score: -1.00%

Function 05DE7A87 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a3fa3232fb3d1fb6a8debb9084950746335d023af95f2ebe2ff78dc8fa068f
Instruction ID: a1e22236d09156941eb631bdf22d604af9c6316b4bee42d61b195a113e0c21b7
Opcode Fuzzy Hash: 01a3fa3232fb3d1fb6a8debb9084950746335d023af95f2ebe2ff78dc8fa068f
Instruction Fuzzy Hash: 08C09B3794845EC44A60F5E87C420ECF315D4C05397100363D37F510D14671D3650157

Uniqueness

Uniqueness Score: -1.00%

Function 055EB7D8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 055ED322 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cbac07c4100328ccfa52f5a30968f99b4c4ba8b50ad8044aaff7c26d3edbd77
Instruction ID: 53b92ba0906e7799baa309e4e76c28a52979b3689ebdb448919557c33fbc3d41
Opcode Fuzzy Hash: 9cbac07c4100328ccfa52f5a30968f99b4c4ba8b50ad8044aaff7c26d3edbd77
Instruction Fuzzy Hash: 48C08C351282882FC201C7A4F812B60BFA8DBC9204F08C498E88C87302CE23A803CA84

Uniqueness

Uniqueness Score: -1.00%

Function 055E8F27 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b654cd8f40f75383352be147b248d2b5fa41a3b5d3722f28c18e850d1db9e4
Instruction ID: 84509d62d2f3100d5b156c79ad00d0c5b8029e91a97ff7683fc05945a949e8ae
Opcode Fuzzy Hash: f1b654cd8f40f75383352be147b248d2b5fa41a3b5d3722f28c18e850d1db9e4
Instruction Fuzzy Hash: 65D0C9351004409BC308CB10C991B91B7A1EF89208F18C94D958A4B252DB32EC27DB44

Uniqueness

Uniqueness Score: -1.00%

Function 055ECF98 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 055EAFB1 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91586782f6cc5e1a139034004c2cd67c8cb0b410c4ffb85ec249d633cc8b5141
Instruction ID: f1fe4660c018afd36513a12338ecaadf55befacf35505163873dd744c19de716
Opcode Fuzzy Hash: 91586782f6cc5e1a139034004c2cd67c8cb0b410c4ffb85ec249d633cc8b5141
Instruction Fuzzy Hash: 9DC08C322181841EC30987E8B812B28FFA8EB85504F08C49CF48C8BA02CE23A903C288

Uniqueness

Uniqueness Score: -1.00%

Function 055EAA30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 055EBA92 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0b426208ff096386893995ac8aa9d29814a313c86746e8a8ee4578298b9cd6
Instruction ID: 04987bc9aa72bfa89958f9f2cdbe3078abf32316fdc8358d7263712322b5dd77
Opcode Fuzzy Hash: ad0b426208ff096386893995ac8aa9d29814a313c86746e8a8ee4578298b9cd6
Instruction Fuzzy Hash: FFC08C311080144FD608D7A8EC42B15B7B9EF8560CF59C0A8E80C9B213CA32FC1BC7C8

Uniqueness

Uniqueness Score: -1.00%

Function 057F0940 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 057F3C00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 057F9B20 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 055EA589 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7a18b1c960b8c823675644a9572aff1bb11c25e8e57cd3e29611c7efed852d
Instruction ID: 2c596405410fbf68e95c643af3f64e3e787fab53f774b7be90ff8793261a6399
Opcode Fuzzy Hash: 2b7a18b1c960b8c823675644a9572aff1bb11c25e8e57cd3e29611c7efed852d
Instruction Fuzzy Hash: 50C09B312581445F8245D6D4F497865BB99DAC5618354C4DDF54C87242CE37E8038694

Uniqueness

Uniqueness Score: -1.00%

Function 055E8610 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction ID: 19d07928bc24b9474f7e59cbdd8b8e0d3deed1c7a519eb3c8c8690cf2c067a2b
Opcode Fuzzy Hash: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction Fuzzy Hash: C5C092303082084B8748D69DE851825F3DA9BCC618328C0BDA80DC7352EE23FC038684

Uniqueness

Uniqueness Score: -1.00%

Function 055E72E0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction ID: 19d07928bc24b9474f7e59cbdd8b8e0d3deed1c7a519eb3c8c8690cf2c067a2b
Opcode Fuzzy Hash: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction Fuzzy Hash: C5C092303082084B8748D69DE851825F3DA9BCC618328C0BDA80DC7352EE23FC038684

Uniqueness

Uniqueness Score: -1.00%

Function 055EA590 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 055E85B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 055E8420 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 055ED270 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 055E6F80 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 055E6EA0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 055E8960 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 055EBB00 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 057F35C0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 057F2740 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 057F5F30 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Uniqueness

Uniqueness Score: -1.00%

Function 05D9CD50 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611154755.0000000005D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d90000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction ID: 20159973dc6c4478fa717a34ac84a2881d4813b9dc5cbab7339b5de6a68ee492
Opcode Fuzzy Hash: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction Fuzzy Hash: 0DB01231250208CFC300DB6CE444C0033FCAF4DA1431000D0F10C8B331C721FC008A40

Uniqueness

Uniqueness Score: -1.00%

Function 055E7350 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction ID: bde584bcc0a20163e1d20aefd562f14664055d751c7398f878511897cdc0a054
Opcode Fuzzy Hash: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction Fuzzy Hash: DFB012301042084B8100D6C8D841810F39CDB84518314C099980C47302CA23FC038580

Uniqueness

Uniqueness Score: -1.00%

Function 057FC1C0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e2839fb080d70fd9d5ab266c8ff45246f4c7246a28781672dbb782ec4b6ef3
Instruction ID: cfd3c94acb28e12ede7e7a80c62375d018fe088f1f186957f4485c32e65079b3
Opcode Fuzzy Hash: f4e2839fb080d70fd9d5ab266c8ff45246f4c7246a28781672dbb782ec4b6ef3
Instruction Fuzzy Hash: 6CB092301602088F82009A59E448C0137ACAF08A0434100D0E1088B632C621F8008A51

Uniqueness

Uniqueness Score: -1.00%

Function 057FFEA0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24626ff33e9090c86f328028cd8591b3165bffb3e899263fda7110a3e0579b6f
Instruction ID: ee58598a29c05c36323d77ffd5f3389d55df6ac412f11b8d30f45fbc6d03bf37
Opcode Fuzzy Hash: 24626ff33e9090c86f328028cd8591b3165bffb3e899263fda7110a3e0579b6f
Instruction Fuzzy Hash: 41A022B0002F0C82CA0032B02802820338C088020C3C008B8A20C0EA220C3BE0F3A088

Uniqueness

Uniqueness Score: -1.00%

Function 05DE61B0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2611832649.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5de0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc69fccf0cdba2440dee369cbc5b4d551c8184b874dd058daffc292e10c53c62
Instruction ID: 5300262280daddd905787f69273869539307d76feb6e3b74bb22def540caed50
Opcode Fuzzy Hash: cc69fccf0cdba2440dee369cbc5b4d551c8184b874dd058daffc292e10c53c62
Instruction Fuzzy Hash: 2AA0023296961181D51462757D4973F10E6AD110F8B6C0327DD72C03D9E750C2014555

Uniqueness

Uniqueness Score: -1.00%

Function 055EF2A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d7b9f5b9239cca7a76702ba7418f479da36de754a9a82a687f44318e85f513
Instruction ID: d64c2e7b9cbf46a684f23bcc4e51371c920cdda7cb62fe872a1f8ea66dbda58f
Opcode Fuzzy Hash: 79d7b9f5b9239cca7a76702ba7418f479da36de754a9a82a687f44318e85f513
Instruction Fuzzy Hash: 84900235065B4C8B4A402FE5740E5567B5CB9545257850051B50D415419F56641145E9

Uniqueness

Uniqueness Score: -1.00%

Function 057F6190 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac29142a4de7843a7e98af33394af4dfa081e656e118ee2cdc9c18950ec42d1b
Instruction ID: c3efe0dc7ee4fbbeaef65ffad0d4346799232136bc84c73a33bbe8110ea5e52b
Opcode Fuzzy Hash: ac29142a4de7843a7e98af33394af4dfa081e656e118ee2cdc9c18950ec42d1b
Instruction Fuzzy Hash: 1E90023205460C8B66416795740A5957F5C954556A7880151B50D425415E9A64D08599

Uniqueness

Uniqueness Score: -1.00%

Function 057FFEE0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2605699733.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_57e0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c86323312791c7199f1ee53c72fdfc921fb664e8d37815168057e29bf642ca
Instruction ID: 9f5d1bebf24a8be04d64c47686880e5861179916864e4fafd2666b29fc5f104a
Opcode Fuzzy Hash: 42c86323312791c7199f1ee53c72fdfc921fb664e8d37815168057e29bf642ca
Instruction Fuzzy Hash: B990223008020CCB03803382B00A080BB8CE0000223800200B20C000008F0020808280

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 055E0040 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

(_^q, xrefs: 055E06EB
(_^q, xrefs: 055E06F5
(_^q, xrefs: 055E073B
(_^q, xrefs: 055E0771

Memory Dump Source

Source File: 00000004.00000002.2603956905.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_55e0000_payment_invoice.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 2da5f31e25c6b8eb88bb8d291a9a8c8b785da212240d5dfc44a68217bf9b0683
Instruction ID: 6aa3ca840f1ddd60d5057e7ba6493feba69cc981b63da1539373622718b0207b
Opcode Fuzzy Hash: 2da5f31e25c6b8eb88bb8d291a9a8c8b785da212240d5dfc44a68217bf9b0683
Instruction Fuzzy Hash: 3A514C74B142048FC708AF68D45896EBBB2BF89304B50896DE556AB3A1DF31EC85CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: notepad.exePID: 2720, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	428
Total number of Limit Nodes:	24

Executed Functions

Function 0155DDE8 Relevance: 3.6, Strings: 2, Instructions: 1081
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 0155E928
$^q, xrefs: 0155E2E8

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID: 2$$^q
API String ID: 0-1071376767
Opcode ID: 2a6e27e83f7a3cadb5be012d2826ea1f4a9861624310871b53c2aba65f5518a6
Instruction ID: 29e953b36b28b3c0c2b07357cef65145e91a065e9d02c695ea6c33c848372480
Opcode Fuzzy Hash: 2a6e27e83f7a3cadb5be012d2826ea1f4a9861624310871b53c2aba65f5518a6
Instruction Fuzzy Hash: D4C2A6B4E01229CFCB64DF69C994A9DBBB6FB49300F1085EAD509AB355DB309E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04E4EF50 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 04E4EFF2

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: cd06d0e67ff655b3e4aa3a17bea4e178508d2457d37095a5a71af5f466ae88d0
Instruction ID: acea3ad7391958050de11a36ee3844c9941a603d0ea84286c53f16746eef7486
Opcode Fuzzy Hash: cd06d0e67ff655b3e4aa3a17bea4e178508d2457d37095a5a71af5f466ae88d0
Instruction Fuzzy Hash: F041E0B5D05258DFCB10CFA9D484AEEFBF0BB49310F14942AE455B7240D738AA89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04E4EF32 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 04E4EFF2

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 20e7d59cfeda02299f8e5d4d61961f42fcd65218cc85d5e5d42ffde31dd2eb4d
Instruction ID: 8407547744f53878cced59f477d6838f6c5c37883c7ad328cd3d561fff3e370e
Opcode Fuzzy Hash: 20e7d59cfeda02299f8e5d4d61961f42fcd65218cc85d5e5d42ffde31dd2eb4d
Instruction Fuzzy Hash: 7241F2B5D042588FCB10CFA9D480AEDFBF1BF4A314F14905AE455B7250C739AA89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04E4EF58 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 04E4EFF2

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2a33c5d888724fd492f202c06f4439ed9feaed4c9d1bd291f84e7944a5a7d862
Instruction ID: 852f3d41dbd4b49f94cb6f37fdc3bc6cf8a8c8713d7f71f4f430aaeb743fe3fe
Opcode Fuzzy Hash: 2a33c5d888724fd492f202c06f4439ed9feaed4c9d1bd291f84e7944a5a7d862
Instruction Fuzzy Hash: 2741EEB5D04258DFCB10CFA9D484AEEFBF0BB49310F14942AE455B7240C738AA89CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0658D4B8 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 0658D5BD

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: d5f6e30db7a923e0423aa86517d0735fce4bc961bffdceccefda5e1b44756588
Instruction ID: 552102109bb8c353f137e978f0392b275cae1df2fbdd7ca504b48988da36a7e4
Opcode Fuzzy Hash: d5f6e30db7a923e0423aa86517d0735fce4bc961bffdceccefda5e1b44756588
Instruction Fuzzy Hash: D1D1CF74E012198FDB54DFA9D994A9DBBB2FF88300F1081A9D409AB3A5DB31AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05911560 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e992c14eff90d121692626aa26fe9ec8c91d517054bf1283d6ec104f21b0d7
Instruction ID: 85bef85d01cce11cc62fc9cbee91823d04ea7d5c4b711fde4282b3d351cac956
Opcode Fuzzy Hash: c2e992c14eff90d121692626aa26fe9ec8c91d517054bf1283d6ec104f21b0d7
Instruction Fuzzy Hash: 48C158B4D05229DFDB64CF69C984BD9BBF5BB49300F0081EAD90DA7250EB349A84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 015509E0 Relevance: 2.6, Strings: 2, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 01550A8A
Te^q, xrefs: 01550A77

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: bacb6c246a7f5564bea855dc7aca8081fa2b29c16400ef4c539ac73c6c126f04
Instruction ID: c3b159d0fe70681f6aeeffc6a8d61eeeed2f34006a582a8dda4d0386988576d2
Opcode Fuzzy Hash: bacb6c246a7f5564bea855dc7aca8081fa2b29c16400ef4c539ac73c6c126f04
Instruction Fuzzy Hash: 82316474E002199FCB58DF69D9A46ADBAF6BF88700F14456AE405EB3A4DB705D01CB41

Uniqueness

Uniqueness Score: -1.00%

Function 01550A32 Relevance: 2.6, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 01550A8A
Te^q, xrefs: 01550A77

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: f0d0b5040a6bb31a72689835fc4fd104cc596a08662e761fad9dd6f56995b6b9
Instruction ID: 03966f446551749c9bd4ac3910bfe1d8827cf470484138d762ed3c6c6ae6b7ea
Opcode Fuzzy Hash: f0d0b5040a6bb31a72689835fc4fd104cc596a08662e761fad9dd6f56995b6b9
Instruction Fuzzy Hash: 4A216230B0011A8FCB54EFADD56866DBAF2BF98700F24456AE401EB3A4CFB05D41CB41

Uniqueness

Uniqueness Score: -1.00%

Function 059108C1 Relevance: 2.5, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4, xrefs: 059110C0
#, xrefs: 059108F1

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: #$4
API String ID: 0-353776824
Opcode ID: 1e00e2656787f35a5b318cea87bd2eb685b238cab74e197d7ac23ca8319d6ba6
Instruction ID: 916667da563fefc435ce97da1dc16527c7cb79a900fb386e5b57d42e54d41ecc
Opcode Fuzzy Hash: 1e00e2656787f35a5b318cea87bd2eb685b238cab74e197d7ac23ca8319d6ba6
Instruction Fuzzy Hash: 301192B090226CDFDB64DF54DA98BEDB7B2BB05704F404499D609AB244D77A5E84CF08

Uniqueness

Uniqueness Score: -1.00%

Function 05910A68 Relevance: 2.5, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 0591075E
@, xrefs: 05910A78

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: 1$@
API String ID: 0-1574762115
Opcode ID: 0c399466a2cff4de7dd548c40003c6eabfabf6068159a52063e480d23a6df285
Instruction ID: 72508cc5f5052b73b7056e1aedbd755758490dbef62f6ab2fb39338060c9db5a
Opcode Fuzzy Hash: 0c399466a2cff4de7dd548c40003c6eabfabf6068159a52063e480d23a6df285
Instruction Fuzzy Hash: 1501BDB4906268CFCB20CF15C988BE9B7B5FB06311F4484E6D90AAB204C7799EC5CF48

Uniqueness

Uniqueness Score: -1.00%

Function 059107E4 Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0591083E
D, xrefs: 05910815

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: $D
API String ID: 0-1196817373
Opcode ID: c14a9f8e8273be79be4e53464c5d76e111cf6218d74cc1379e0e2e990825e010
Instruction ID: 7b11df8dc474b4142082db9d553a2e5608b1df50ccde9762a85a9bb47d40ecee
Opcode Fuzzy Hash: c14a9f8e8273be79be4e53464c5d76e111cf6218d74cc1379e0e2e990825e010
Instruction Fuzzy Hash: 7AF07AB480126DCFDB24CF15CA88BE8BBF2BB09305F4085E6D54AA6654D3B95EC4CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0591076D Relevance: 2.5, Strings: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 05910BF6
F, xrefs: 05910778

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: %$F
API String ID: 0-2945472538
Opcode ID: 7a0ff86028cdee641399e78ad30cffec996e39ee62e41939bac3738ef4666c42
Instruction ID: f33afb150ebdbe55d12e303522131090db5e47966fe455da38ad3143ad3aa597
Opcode Fuzzy Hash: 7a0ff86028cdee641399e78ad30cffec996e39ee62e41939bac3738ef4666c42
Instruction Fuzzy Hash: F7E0C27484222CCFDF24CF21CA48BE9BBB6FB06305F105599880D632A1D7794A89CF04

Uniqueness

Uniqueness Score: -1.00%

Function 0658E978 Relevance: 1.9, Strings: 1, Instructions: 677
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 0658ECF3

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 60695ec218b566fc5aa40315326c3dd3632a051dd8d72c5111b137f53b0942ba
Instruction ID: 1af96262427f4533a5cf502166365f5a4dcb3f87b8c08a5043c7e1e2a6ddba6c
Opcode Fuzzy Hash: 60695ec218b566fc5aa40315326c3dd3632a051dd8d72c5111b137f53b0942ba
Instruction Fuzzy Hash: 38521975A102288FDB68DF68C985BEDBBF6BF88300F1541D9E509AB351DA309D81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04E4CB9E Relevance: 1.8, APIs: 1, Instructions: 271
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04E4CE0F

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4c63acef943eb52c2f00907bb2bb91175965f78aad372f9a8dff221ed6be98bc
Instruction ID: 45fe28ff8073c34670c7f8631c1160111e0fe3d963c5bae1d843372c07f9238c
Opcode Fuzzy Hash: 4c63acef943eb52c2f00907bb2bb91175965f78aad372f9a8dff221ed6be98bc
Instruction Fuzzy Hash: 13A123B1D012198FDF10CFA8D8417EDBBB1BF49314F25A16AE859B7280DB34A985CF85

Uniqueness

Uniqueness Score: -1.00%

Function 04E4CBA8 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04E4CE0F

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 61ef05e82f4afa1ed17635fe5e59ec43cd36c71c2d4035a7fb87e4ab0126ef5d
Instruction ID: 488386294f66ec8df392779f5c948235fc55c6eb04de54642dcebee0a7af97c4
Opcode Fuzzy Hash: 61ef05e82f4afa1ed17635fe5e59ec43cd36c71c2d4035a7fb87e4ab0126ef5d
Instruction Fuzzy Hash: 9BA114B0D012188FDF10CFA9D8417EEBBB1BB49314F25A16AE859B7240DB749985CF85

Uniqueness

Uniqueness Score: -1.00%

Function 04E4D890 Relevance: 1.6, APIs: 1, Instructions: 117injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04E4D968

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6577db988340417ab9e7d9618d5c716f8931637098ca2548678b59f160097388
Instruction ID: 4ccc022b0d7288c142ea5f273e164e9a7e159ae9f3e507443a2cd3953da04bc5
Opcode Fuzzy Hash: 6577db988340417ab9e7d9618d5c716f8931637098ca2548678b59f160097388
Instruction Fuzzy Hash: E241ABB5D012589FCF00CFA9D984AEEFBF1BB49314F14902AE819B7210D375AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04E4D898 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04E4D968

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 852fd7c03ea0fe7e0929e9a0b335a45653b99b3045fc426bae4242b4016a0f11
Instruction ID: 6992650097bb00b2c0b185cedb7f6ba2cc38e8362206b37cb0332245d6bcde3b
Opcode Fuzzy Hash: 852fd7c03ea0fe7e0929e9a0b335a45653b99b3045fc426bae4242b4016a0f11
Instruction Fuzzy Hash: 0C41AAB5D012589FCF00CFA9D984ADEFBF1BB49314F20902AE819B7210D775AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04E4D5D0 Relevance: 1.6, APIs: 1, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04E4D682

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9821138f4a0a11a546e8459dd8c7ad02b4b2f1df460a7d6cd549ef747cf468a4
Instruction ID: 2c82f23bb24b4c59cc651a6f47de64ff3aeadbb522c6962b204134ce9a41b23c
Opcode Fuzzy Hash: 9821138f4a0a11a546e8459dd8c7ad02b4b2f1df460a7d6cd549ef747cf468a4
Instruction Fuzzy Hash: 3A41BAB5D00258DFCF10CFA9D980ADEBBB1BB49320F10A42AE819BB214D735A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04E4D5D8 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04E4D682

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e7dbc1945f92e7ae03fc791afab7f6054ec340806f301ee540429978086676f7
Instruction ID: 21b96890848d661473bfe14ff9f314a75638f275f951b6ac517103eea5e871ca
Opcode Fuzzy Hash: e7dbc1945f92e7ae03fc791afab7f6054ec340806f301ee540429978086676f7
Instruction Fuzzy Hash: CE3188B9D042589FCF10CFA9D980ADEFBB5BB49310F10A42AE819BB210D735A945CF59

Uniqueness

Uniqueness Score: -1.00%

Function 04E4D592 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04E4D682

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cdc71fe63410003666a37755a0817b0666586c0c3c7e41db371f1d4d16a34a1b
Instruction ID: 07e967bebd81f48b738319adbf70564f4ed1deeecaa57c0b44fe715b94c8741c
Opcode Fuzzy Hash: cdc71fe63410003666a37755a0817b0666586c0c3c7e41db371f1d4d16a34a1b
Instruction Fuzzy Hash: 9631D0B4E05249DFCF00DFA8E984AEEBBB1BF49314F10A46AE804B7211D735A945CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04E4CF52 Relevance: 1.6, APIs: 1, Instructions: 95threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04E4D007

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 345ff8934709ad65b981b7a6c9728de5c73c3e3c8828866df988f4b2a812b4af
Instruction ID: 15ce6a68b77a8d7f006ca38acf7e0b3b436d27bbb1fc9dd514eb8162605b025a
Opcode Fuzzy Hash: 345ff8934709ad65b981b7a6c9728de5c73c3e3c8828866df988f4b2a812b4af
Instruction Fuzzy Hash: 9541CBB5D012589FCB10CFA9E984AEEFBF1BB49310F24842AE419B7200D738A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04E4CF58 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04E4D007

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2aa73daf0697db7957a9232bc012efcd49d94a7852c595f48b8891a82bb0ed9d
Instruction ID: d81832e2afb159ac33c3d82efc1bae18b9c35f354cdc017f196adb5b827cd183
Opcode Fuzzy Hash: 2aa73daf0697db7957a9232bc012efcd49d94a7852c595f48b8891a82bb0ed9d
Instruction Fuzzy Hash: DB31BCB5D012589FCB10CFA9E884AEEFBF1BB49314F24902AE419B7240D739A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04E4DC30 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 04E4DCAE

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0b3fcb41725021cc33e7e2e42b1b021742a3358b3052efaf49b31790520045fb
Instruction ID: 8d9bb89e9a24bf20edf6d679d6cf6da7c76e3a13c5c4971683b65273ff10d492
Opcode Fuzzy Hash: 0b3fcb41725021cc33e7e2e42b1b021742a3358b3052efaf49b31790520045fb
Instruction Fuzzy Hash: B131CAB4D002189FCB10CFA9E980ADEFBB4EB49320F10902AE815B7310C775A941CF98

Uniqueness

Uniqueness Score: -1.00%

Function 04E4DC2F Relevance: 1.6, APIs: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 04E4DCAE

Memory Dump Source

Source File: 00000005.00000002.2514623442.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e40000_notepad.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 25103a6a32eb791947129f49547de34ddedc1b17caf26969a361c9b8e9cbba38
Instruction ID: 81fbd09fa5b7d959aa5ca735e83d6c3991eff39201b7663a46f1e3661c84a513
Opcode Fuzzy Hash: 25103a6a32eb791947129f49547de34ddedc1b17caf26969a361c9b8e9cbba38
Instruction Fuzzy Hash: 3D31CAB4D002189FCB10CFA9E981AEEFBB0AF49310F14942AE815B7310C734A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04E64108 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 04E64166

Memory Dump Source

Source File: 00000005.00000002.2515435060.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4e60000_notepad.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5205fac6a0537536771297399c909e62b0453c3abb9fed9da6011caca315c954
Instruction ID: e11d2baf5971d1192df304ddb6db2a83f152ed795946d467f1d834ed8d372516
Opcode Fuzzy Hash: 5205fac6a0537536771297399c909e62b0453c3abb9fed9da6011caca315c954
Instruction Fuzzy Hash: 152166B18043598FDB11CF99C4497DEBFF4EB19328F24806AD449AB391C778A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01550B59 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

<duq, xrefs: 01550C44

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID: <duq
API String ID: 0-2704095200
Opcode ID: 9911d6ae8e78998cfe419f65962bad5279e08e8f4c2debc46d547de3843dc077
Instruction ID: 6946569add8cc12ab69f03227b9b4923e3c21a088d1b4133f7fe9abeee856485
Opcode Fuzzy Hash: 9911d6ae8e78998cfe419f65962bad5279e08e8f4c2debc46d547de3843dc077
Instruction Fuzzy Hash: 4951B575A002099FCB45CF98D99099DBBF2FF89324B248896F815EB3A5C731EC52CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06575BC3 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

%, xrefs: 0657DB01

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 1b63c9c4baf45ee2493b7810831ab6915f5e6d2800839ef8e2cb59ebfa02a737
Instruction ID: ae6dec94ce607936d7e3a1709e551a2c487663b32fa78c7bdb111b0ea0547c2d
Opcode Fuzzy Hash: 1b63c9c4baf45ee2493b7810831ab6915f5e6d2800839ef8e2cb59ebfa02a737
Instruction Fuzzy Hash: 721146B0955229CFDBA0DF68D888B9DB7B0FB48308F9050E5D119A7680CB345EC8CF15

Uniqueness

Uniqueness Score: -1.00%

Function 059104B7 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4, xrefs: 059110C0

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 2ff29c9977cfcda6c47ffe04b7625011a8c426d4aa5583adc4b505be80be4962
Instruction ID: efbbfa3eee1c4c1a198256ba5c93e58411436a6f786dae38d35468475f4ece31
Opcode Fuzzy Hash: 2ff29c9977cfcda6c47ffe04b7625011a8c426d4aa5583adc4b505be80be4962
Instruction Fuzzy Hash: 0111A2B0D0226CDFDB25DF59CA58BEAB7F2BB49300F408496D609A7254D37A5D80CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05910F57 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

H, xrefs: 05910F65

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 200ef9ccd564cd30206425c5a27f00c722af74b5410fb8fb89ea1398285d2797
Instruction ID: 11b35e99a86347c49ef1996324c7e9aad3eb799549b39893ac9d9a86aca6fcbb
Opcode Fuzzy Hash: 200ef9ccd564cd30206425c5a27f00c722af74b5410fb8fb89ea1398285d2797
Instruction Fuzzy Hash: B601D27080122CDFDB24CF51C958BEDBBB2FB09301F4084D6DA4AA6290C77A4AD4DF18

Uniqueness

Uniqueness Score: -1.00%

Function 05910434 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

,, xrefs: 05910442

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 2d7cf270361d8818691282a0566ab560896779e304eb604beb2d9751e9c87613
Instruction ID: 181f9e8dfda53b41253f8d8fbfa8a7e8c85a49f07dad138c82f4e2db54478af7
Opcode Fuzzy Hash: 2d7cf270361d8818691282a0566ab560896779e304eb604beb2d9751e9c87613
Instruction Fuzzy Hash: 5401D67080126CDFDB20CF51C958BEDBBB1FB09304F0084D6D649A6294C3794AD4DF54

Uniqueness

Uniqueness Score: -1.00%

Function 01550CC7 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

8bq, xrefs: 01550CE5

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 23990ad8775c4d80af14716617104e30db86cdb27a4c83a755fadafda7742662
Instruction ID: 4de93f700ed72311d980a87614f43020b70f1363e55d9ce358aa182a849b20ed
Opcode Fuzzy Hash: 23990ad8775c4d80af14716617104e30db86cdb27a4c83a755fadafda7742662
Instruction Fuzzy Hash: C4F082386402248FCB45EB69E550AA977F1FB8D241B1441A9E149872A5CB249D46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 059105D8 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

4, xrefs: 059110C0

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 2568fc34a4a5e16055071ac4b7c002fc47baf2dbe8b4a2cf8096f99e1e19e261
Instruction ID: ff085204a3e51c1dd5248bed5c38d54c4ff9ffcc565f0bce6df3fe71fefe106d
Opcode Fuzzy Hash: 2568fc34a4a5e16055071ac4b7c002fc47baf2dbe8b4a2cf8096f99e1e19e261
Instruction Fuzzy Hash: 82F097B490226CDFDB25DF54DE58BDA7BB2FB09300F404495E609AA244D3765D81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05910C7B Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

1, xrefs: 0591075E

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: a842c20dd9299c689167243fcad5c2a23a300d16505433d0e7e747f8593f9b77
Instruction ID: d6d8ec1213042cac5d8305538d62cea9bfc88d928f29e389e335028415865bf8
Opcode Fuzzy Hash: a842c20dd9299c689167243fcad5c2a23a300d16505433d0e7e747f8593f9b77
Instruction Fuzzy Hash: 89F0B270D0522CCFDB28DF21C958BEDB7B1BB49300F40559A880A67251CB745EC5CF05

Uniqueness

Uniqueness Score: -1.00%

Function 06576B5F Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

K, xrefs: 06576B85

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 5ba8d737fa085f66fd34c13a7513165bfd5c3eb815a90134c4b1e2a6bec27f29
Instruction ID: 079bfd29c759fa1e34becbf38f7491f0a2202cfd4511e877f78d482a942d6eec
Opcode Fuzzy Hash: 5ba8d737fa085f66fd34c13a7513165bfd5c3eb815a90134c4b1e2a6bec27f29
Instruction Fuzzy Hash: A7F034B4D0422ACFDB659F64D848BDA77B0BB09305F0080E49218A7680C6785EC88F51

Uniqueness

Uniqueness Score: -1.00%

Function 05910715 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

1, xrefs: 0591075E

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: d4cdfff23e30f0bc22b92d75d1c6d70c4c10f9c15f58da476efff3b91f9fdbd6
Instruction ID: 13c81d689b3036a8a1905577d4d9b17c7afcee8add70f2435d14f9762144cc7e
Opcode Fuzzy Hash: d4cdfff23e30f0bc22b92d75d1c6d70c4c10f9c15f58da476efff3b91f9fdbd6
Instruction Fuzzy Hash: 94E0C2B4D012288FCB69DF21D894ADCBBB1FB88300F40459AD40AA7365CB309E85CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05910318 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

A, xrefs: 0591034F

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 1314e11925a276e5f9a3bd647c9359695d63ec82f58f18133e164338aa38b52f
Instruction ID: ebcf045cca677b5f8f075c99d1307f4c2d5089c42621218069acc819b88c7d8f
Opcode Fuzzy Hash: 1314e11925a276e5f9a3bd647c9359695d63ec82f58f18133e164338aa38b52f
Instruction Fuzzy Hash: 9BE0B6B59443299FDB24CF50CD15BEDBBB1FB04305F004195EA09A6291D3785E85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05910582 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

1, xrefs: 0591075E

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 2648bdb576fdec18a54435f18f53f0418dafe5d03f15e40daecfb390abd113b2
Instruction ID: d7cdfd857382b2a43913404f82522f09aa87e828f189cd988fabfb54b7961e3d
Opcode Fuzzy Hash: 2648bdb576fdec18a54435f18f53f0418dafe5d03f15e40daecfb390abd113b2
Instruction Fuzzy Hash: CFD06CB89063288FCB50CF61D998AEDBBB5EB49310F059496E80AA7314D6749EC2CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05911550 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf94700996b0ea18216aa57337f85c5bd8e1de57e3deb605bab3116ad2d784b
Instruction ID: 25f1f894033c6e330ec24cf0d4fc75bb58fdd312a6c1992232fc244f6997d68b
Opcode Fuzzy Hash: 0cf94700996b0ea18216aa57337f85c5bd8e1de57e3deb605bab3116ad2d784b
Instruction Fuzzy Hash: 83B169B4D05229DFDB64CF69C984BD9BBB5BB49300F0081EAE90DA7250EB349E85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05911601 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e73745f6347bf1f8f669eed76b7f692e40c2f977200523d8dba8c660d20c627
Instruction ID: 6401790f2eddb13e1d4e6b489d02e701f59150faa42e68f65bd5cf97abd1bf0b
Opcode Fuzzy Hash: 3e73745f6347bf1f8f669eed76b7f692e40c2f977200523d8dba8c660d20c627
Instruction Fuzzy Hash: 74B169B4D01229DFDB65CF69C984BD9BBB5BB49300F0081EAD90DA7250EB309E84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05911822 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f7cac4068c411e3abb03b5ca91b002c4d2ccc1dcdda897949319898570dca1
Instruction ID: 54450e3b04bfb71482e1bb8b895707199e4b57345bc80ff53d42880c899a8772
Opcode Fuzzy Hash: 38f7cac4068c411e3abb03b5ca91b002c4d2ccc1dcdda897949319898570dca1
Instruction Fuzzy Hash: 09B14AB4D06229DFDB64CF69C984BD9B7F5BB49300F0081EAD90DA7250EB349A85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05911B25 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30626e3477ba8637fa84431a7d49a1302979ab7c96f5fd94e8031cc0918f1bdc
Instruction ID: 9a0d2d106ee15c7a347a9508a08fdcbfc837ec89f301a70ee870106068d8ccba
Opcode Fuzzy Hash: 30626e3477ba8637fa84431a7d49a1302979ab7c96f5fd94e8031cc0918f1bdc
Instruction Fuzzy Hash: 86B168B4D05229DFDB65CF69C994BD9BBB5BB49300F0081EAE90DA7250EB349E84DF04

Uniqueness

Uniqueness Score: -1.00%

Function 059118B0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4dc0fd12f9f0cb7b89b8a1e3202cc397f7fa9e81c9c5ca496b03cb51f8c1140
Instruction ID: 23c48956e95bdb0fe95ea4d06b07c499c79d8a35fe55b6e1bc298f688c304e19
Opcode Fuzzy Hash: c4dc0fd12f9f0cb7b89b8a1e3202cc397f7fa9e81c9c5ca496b03cb51f8c1140
Instruction Fuzzy Hash: 68B169B4D01229DFDB64CF69C994BD9BBB5BB49300F0081EAE90DA7250EB349E84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05911AB0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9821eeca5a11f7c53baa8f47e3c6fc5186138ecc22fd7dcc1bfe41cd5d448a90
Instruction ID: af1ff371f50d344c1f6f9f010f3d211a8b0289ec9142c3f0eb08e03d234a89a9
Opcode Fuzzy Hash: 9821eeca5a11f7c53baa8f47e3c6fc5186138ecc22fd7dcc1bfe41cd5d448a90
Instruction Fuzzy Hash: 8CB168B4D01229DFDB64CF69C994BD9BBB5BB49300F0081EAE90DA7250EB349E85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05911981 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada216472bde5bef7ca5ae88df9f251c95747fbdcb31bf0341fb40037a1139d9
Instruction ID: 54ad08c976594da0284fd295bbe0e5d2ef5e07736f1077c637887b9f3dd1bda3
Opcode Fuzzy Hash: ada216472bde5bef7ca5ae88df9f251c95747fbdcb31bf0341fb40037a1139d9
Instruction Fuzzy Hash: D9B169B4D05229DFDB64CF69C994BD9BBB5BB49300F0081EAE90DA7250EB349E84DF04

Uniqueness

Uniqueness Score: -1.00%

Function 05911907 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a0c38c509e6d11408fa777226e21c92962c8c6c4f70a8c9a076e94291eab55
Instruction ID: ce62ea84c916ac8ae693fa604b176b7aaf03bc5341ba641312697b93360287f6
Opcode Fuzzy Hash: a4a0c38c509e6d11408fa777226e21c92962c8c6c4f70a8c9a076e94291eab55
Instruction Fuzzy Hash: DEB158B4D05229DFDB64CF69C994BD9BBB5BB49300F0081EAE90DA7250EB349A84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05911789 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a4258274f89f5b3b27aeec0d808802c584968add6f17f282ae2cd7b01bc8e9
Instruction ID: 9f3a54e20a32dba3e109cc30044550b83f1af8c9c3de28b99aa27c68e32f9125
Opcode Fuzzy Hash: d2a4258274f89f5b3b27aeec0d808802c584968add6f17f282ae2cd7b01bc8e9
Instruction Fuzzy Hash: FBB157B4D05229DFDB64CF69C984BD9BBB5BB49300F0081EAE90DA7250EB349A84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05911723 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757c96563b911010d775f8501351012b03b1ebecb73b60cc1e8ecdf5869aff3a
Instruction ID: 160a2a00d8e61febc27a09556c21aba334245f3ad6b6cb1e8c2c1f40e6f900d9
Opcode Fuzzy Hash: 757c96563b911010d775f8501351012b03b1ebecb73b60cc1e8ecdf5869aff3a
Instruction Fuzzy Hash: F5A169B4D05229DFDB64CF69C984BD9BBB5BB49300F0081EAE90DA7250EB349E85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 01550882 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2befa5431b3db2306378a00a774280bf8dcf96e623fef6bd6d4ebc16670178
Instruction ID: f8b3471c76c06d3d6f8482fc51da9cc80b7dda095a7cd1ecaf8d4a329764b58b
Opcode Fuzzy Hash: 0b2befa5431b3db2306378a00a774280bf8dcf96e623fef6bd6d4ebc16670178
Instruction Fuzzy Hash: 7E416D78A002068FDB15DF69D951AAEFBF1FF89300F04866AE814EB355E734E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015508A8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fe3a14d8752a979908d8e54dea75ed77552767078d82e864b134701899461d
Instruction ID: 96a8b637096431d833faba4bf817e87fd6fc357e21aba4c0c4fcc39982752768
Opcode Fuzzy Hash: a8fe3a14d8752a979908d8e54dea75ed77552767078d82e864b134701899461d
Instruction Fuzzy Hash: 0B316378A002168FCB15DF69D9519AEFBF1FF88300B10C62AD814AB345E734E945CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0126D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2480613975.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_126d000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7291f4904ac0d3cb643e92578ab8e99a70527ae7e8e51f703444b8e95459b801
Instruction ID: afc8b976b1766b9f78cbdcacdd75fe1fa5b1567084fa29eb223ce02185c3fc58
Opcode Fuzzy Hash: 7291f4904ac0d3cb643e92578ab8e99a70527ae7e8e51f703444b8e95459b801
Instruction Fuzzy Hash: 8C21677121424CDFCB11DF58D9C4B27BF69FB84314F24C569E9490B282C336D48AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0155C6F8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341c23c58409cb44500c91b03e51b1c32bd245685257b246834e6e3d7aabdb82
Instruction ID: f7b954377de8db3aa0eba7ac3a038e162352aad40aa666de1e62e22180c48f02
Opcode Fuzzy Hash: 341c23c58409cb44500c91b03e51b1c32bd245685257b246834e6e3d7aabdb82
Instruction Fuzzy Hash: A5215C70D65308DFDB84DFA8D0587AEBBF9FB49304F1094AAD809AB641EB744A85CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0126D017 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2480613975.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_126d000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
Instruction ID: ec687950850c7bacf32709e03369f2cb9ef745e87fa8cb3e1c3f2412da7195e7
Opcode Fuzzy Hash: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
Instruction Fuzzy Hash: B0110076504288CFCB12CF14D5C4B16BF72FB84314F24C6AADD490B696C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05912738 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d517b64c7eba9d5a5d1586e0baf0dfbff18344f8aa1c24d9d27f1fdae87bb4bc
Instruction ID: 8d28eb7cc3406fea5e442a3f480b26ff9d617d3a92e1d9a151b89bba635d6bf2
Opcode Fuzzy Hash: d517b64c7eba9d5a5d1586e0baf0dfbff18344f8aa1c24d9d27f1fdae87bb4bc
Instruction Fuzzy Hash: 1001C078D0810CEFCB04EFA5E5446ADBBB5EB48214F20C0FADC0463390D6359B02EB44

Uniqueness

Uniqueness Score: -1.00%

Function 0658D940 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35611cf232f5caa7c1affb0a90078d0fa70792360bdade28399acaccefb6eb1d
Instruction ID: aae6e4aa6daca22941835273205aca55abff417afe9550088db865882640058a
Opcode Fuzzy Hash: 35611cf232f5caa7c1affb0a90078d0fa70792360bdade28399acaccefb6eb1d
Instruction Fuzzy Hash: 7B11B7B0E0021A9FCB48DFA9D9456AEBBF5FF88300F10856A9418B7354DB359A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0591278B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0c29fcd4d51d5328fb8ce706af77d8ba8c8d7cdbcdb51d3a890ddee451616a
Instruction ID: 9899f5fa250d8deb90514d689e5113ffbde08a37fffe0b1c29fba1ca9c3d0145
Opcode Fuzzy Hash: 1e0c29fcd4d51d5328fb8ce706af77d8ba8c8d7cdbcdb51d3a890ddee451616a
Instruction Fuzzy Hash: 2001AF3A90510CEFCF05DF94D9416AEBBB5EB48300F1484A9FC0993350D632AE21EB41

Uniqueness

Uniqueness Score: -1.00%

Function 059114E0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490862f99f9ab4cffd5c3b66b13476e7789b9ace64eec71d94622967e4e28408
Instruction ID: f17c9dd78773e5d41663cfc8e8c0a99563670cd42449956b9830901fbe84cf51
Opcode Fuzzy Hash: 490862f99f9ab4cffd5c3b66b13476e7789b9ace64eec71d94622967e4e28408
Instruction Fuzzy Hash: C601FB71D0031AEBCF01DF95D8409E9BB75FF49311F10C51AE95963210E735A996DF90

Uniqueness

Uniqueness Score: -1.00%

Function 059127E0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241ce1f5bad22e0c6fed884c8fe83df5c9ed48187d72aa6324ae30e691054ff3
Instruction ID: cce2f83584643dbe1ebf9b17f26d6b215f60bd4c8dc4147d1293a27ff9efa18c
Opcode Fuzzy Hash: 241ce1f5bad22e0c6fed884c8fe83df5c9ed48187d72aa6324ae30e691054ff3
Instruction Fuzzy Hash: 6BF0497980420CAFCB05DFA5E841AADBFB5EB49310F14C1EAED54A2350DA369A61EB44

Uniqueness

Uniqueness Score: -1.00%

Function 0658FE00 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb7171d57b9b2fd56b8e0e6a19584b819cb8a8aac429ab14021428c8c772bbd
Instruction ID: c2d7e6002bb5ad4ac2aaa578766df5a39cc209a648b8b41d7baf5c6c9232a3f1
Opcode Fuzzy Hash: 3fb7171d57b9b2fd56b8e0e6a19584b819cb8a8aac429ab14021428c8c772bbd
Instruction Fuzzy Hash: CCF036312503095FC710DF19DD80D8BFBAAEFC4310B008A3AB51A87665DBB0E9498690

Uniqueness

Uniqueness Score: -1.00%

Function 0591035E Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b4523ab4c9d7dd5be7939de80fb132aebbe970f95436c9d40d6b3eb71d3eb1
Instruction ID: c82ee8fcf844d503c6942bb3a12b6d5f6473d433c37ce93adfb5c275d9529aad
Opcode Fuzzy Hash: 98b4523ab4c9d7dd5be7939de80fb132aebbe970f95436c9d40d6b3eb71d3eb1
Instruction Fuzzy Hash: 5701CE70901269DFDB28DF51C958BECBBB2BB09300F4088DAD60AA6254CB760EC4CF14

Uniqueness

Uniqueness Score: -1.00%

Function 059114F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed5415a67ae42e1e43ed1a64433baaeeb154ea95c6f55188645405038774874
Instruction ID: cf9d3fcf5d4af4a41cb94174f51716d69541d607436a1eecd234518edcb0adc1
Opcode Fuzzy Hash: eed5415a67ae42e1e43ed1a64433baaeeb154ea95c6f55188645405038774874
Instruction Fuzzy Hash: 90F0E73190021EEBCF01DF99D8009EEBB75FF89320F10C519EA5927250D735A6A6DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0658FF38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b12ec6343802f414614f9f09601b22ffb5356a528cd3d62bfc79fdf72eb1bc
Instruction ID: 432e216901868d88dd9355f4b1b02aa81d2c47d09bccd596fa7361f67cd20124
Opcode Fuzzy Hash: 97b12ec6343802f414614f9f09601b22ffb5356a528cd3d62bfc79fdf72eb1bc
Instruction Fuzzy Hash: 38F05E353106049FC708DB29D858D2A77AAEFC8721B1040AAFA068B360CA71EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05910B47 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c2401c1c75c88ecc886b921393b0ec70c91e90416f22d16302581178918602
Instruction ID: d12e1819d81de359bfeae1081b4c564231c43bac0bf4015852a41b14ba56c3c7
Opcode Fuzzy Hash: 97c2401c1c75c88ecc886b921393b0ec70c91e90416f22d16302581178918602
Instruction Fuzzy Hash: E601EF74941228DFDB20CF44CA88BE9BBB1FB09304F1484DAE609A7241D37A9EC1CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05911EF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d2cc859670533a4c0d020ee1f675c8777b7c2bb17cd7d789a35a5561137ef0
Instruction ID: 70a7ab7a73d5a96fd3b8c6cc649c530a033a2bbaec8307b57ff19abf65ee2ac2
Opcode Fuzzy Hash: 30d2cc859670533a4c0d020ee1f675c8777b7c2bb17cd7d789a35a5561137ef0
Instruction Fuzzy Hash: 52F0F874908209EFCB05DF94E845AACBBB5FB48314F10C1AAEC5956361D7368A62EB40

Uniqueness

Uniqueness Score: -1.00%

Function 0658DD08 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d267bdcb379fa0f490fdc768a9cc1a6582c18b9306512776646020148acf05c3
Instruction ID: 39b9985072d83a4833039ab5c9be87b3e0838ee8791770bf7d759fd0b8b8e9c1
Opcode Fuzzy Hash: d267bdcb379fa0f490fdc768a9cc1a6582c18b9306512776646020148acf05c3
Instruction Fuzzy Hash: 24F0F874D05208EFCB94DFA9D840AADBBF8EB48210F14C5AAA858E3281D6359A51DF50

Uniqueness

Uniqueness Score: -1.00%

Function 059128C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c64b7a3c845b148e3187273b350b7e7e709f2e7b96f3385564391c37ef6a76
Instruction ID: adb082dad187adf74d5e6be55a9398f7467d12be30f23724dffe05362c9019cf
Opcode Fuzzy Hash: 50c64b7a3c845b148e3187273b350b7e7e709f2e7b96f3385564391c37ef6a76
Instruction Fuzzy Hash: F1F0A074D08208EFCB01DB94D4455ACBFB4EB59200F10C0EADC04A3351DA399A42EB50

Uniqueness

Uniqueness Score: -1.00%

Function 065731DC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c7ab225353ab0fce96681b3f6db4187f55d49f86115654e0444a0c708f605f
Instruction ID: 4522e862bf7cdc657519bdf058b69007f2ff8ccf2def7f353c66d38b699efc76
Opcode Fuzzy Hash: 38c7ab225353ab0fce96681b3f6db4187f55d49f86115654e0444a0c708f605f
Instruction Fuzzy Hash: D0F0C974A11128CFE768DF58D854E9AB7B5FB49300F1042D5D40DAB384CF346D858F50

Uniqueness

Uniqueness Score: -1.00%

Function 05911F77 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc97d42767fb689fc157f149f77f147379e7241483f4e2ed4204aa95ff64dd8
Instruction ID: 56b7b9abe1f9cedbb62e42a78d894d0c9bf29bfff1aaa0c746a8e0a09db42d5d
Opcode Fuzzy Hash: 8cc97d42767fb689fc157f149f77f147379e7241483f4e2ed4204aa95ff64dd8
Instruction Fuzzy Hash: 71F0157490811CEFCB05CF84D840AACBBB2FB48310F14C5AAED1556391C7368A51FB44

Uniqueness

Uniqueness Score: -1.00%

Function 05912798 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7a043b7671103762e6912a7267b713b701239504b2d3736523283f333a9786
Instruction ID: 78e171c77ba2dd4a5fb6ca0b2240cd562f20b8e5037e006da84ba4322e7818ee
Opcode Fuzzy Hash: 9e7a043b7671103762e6912a7267b713b701239504b2d3736523283f333a9786
Instruction Fuzzy Hash: E1F0153890420CEFCF05DF98E8409ADBBB5FB48310F14C4A9EC0853350D732AA61EB40

Uniqueness

Uniqueness Score: -1.00%

Function 059127F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3edc4d7f28d145357505ddc067f994212b6b86365420261737371e8bb844e5f8
Instruction ID: 0f94950847ca6f48903ddfcb23a68d778cfa10d1811659653cc6074483d0944c
Opcode Fuzzy Hash: 3edc4d7f28d145357505ddc067f994212b6b86365420261737371e8bb844e5f8
Instruction Fuzzy Hash: 9EF0153890420CEFCF05DF94E840AACBBB5EB48310F10C4A9EC5452251CA369A61EB84

Uniqueness

Uniqueness Score: -1.00%

Function 05912918 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eeea853177b200d62c586fa757b938da066c747ef34b3bc285458e76016af79
Instruction ID: 5472c9b68c3440a83454fb265dbb39422d639846f5f271625ce78d0d1862f3cb
Opcode Fuzzy Hash: 1eeea853177b200d62c586fa757b938da066c747ef34b3bc285458e76016af79
Instruction Fuzzy Hash: 26F032B4D05208EFCB44DFA9EA447A8BBF8FB88314F1080AAEC099B350DB355A41DB44

Uniqueness

Uniqueness Score: -1.00%

Function 05913578 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b00a716baacdffdac2ed2357ab274bea2d0e0db1181a23d152a0b114b63387
Instruction ID: ca7aba156667e563f8410a3484d3bb9ebf2b3ab1aba15afe30feaa622b98bda1
Opcode Fuzzy Hash: 99b00a716baacdffdac2ed2357ab274bea2d0e0db1181a23d152a0b114b63387
Instruction Fuzzy Hash: 4EE02670428108DFC344DF94E4007B87BB8E762640F44A469D80843302DB325E01D740

Uniqueness

Uniqueness Score: -1.00%

Function 0658BE08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5352eb66daf82647803b78b89632f6e64d4bfac0392273e1e1360b2ec0e75d90
Instruction ID: d3f000165edee0cf839841c2151a49b8c3640f509542f8d1ed408623208eda6d
Opcode Fuzzy Hash: 5352eb66daf82647803b78b89632f6e64d4bfac0392273e1e1360b2ec0e75d90
Instruction Fuzzy Hash: E8E0C974E04208EFCB94DFA8D4446ADBBF5FB48310F10C4A9A808A3350D6359A51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06589090 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5352eb66daf82647803b78b89632f6e64d4bfac0392273e1e1360b2ec0e75d90
Instruction ID: 67724ae25f293982c5fdc73074f41865a24b1222dd101ad57cc6d5e598b93a51
Opcode Fuzzy Hash: 5352eb66daf82647803b78b89632f6e64d4bfac0392273e1e1360b2ec0e75d90
Instruction Fuzzy Hash: E5E0C974E05208EFCB94EFA8D4446ACBBF4EB48310F10C4A99818A3351D6359A51DF81

Uniqueness

Uniqueness Score: -1.00%

Function 06584DA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5352eb66daf82647803b78b89632f6e64d4bfac0392273e1e1360b2ec0e75d90
Instruction ID: e3480841a96e08d910f9ac0a0f3dcc70921cf721e0f6dd5d5165d6ef5c265d62
Opcode Fuzzy Hash: 5352eb66daf82647803b78b89632f6e64d4bfac0392273e1e1360b2ec0e75d90
Instruction Fuzzy Hash: 93E0C274E05208EFCB84EFA8D444AACBBF4EB48310F10C5AAAC18A3350D6359A51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0658D460 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43552b8784ef788727ce43738dde3fdec10878bec6f5ea3c265622de820e0c6
Instruction ID: e33206223107cdf4837565bdd1f95c4de0064ec9b1164d6005a5b5ff5fd023a5
Opcode Fuzzy Hash: f43552b8784ef788727ce43738dde3fdec10878bec6f5ea3c265622de820e0c6
Instruction Fuzzy Hash: 9EE04F7091520CDFCB84EFF8E5452AD7BF4FB49301F1051A9D808A37D0DA741A41DB41

Uniqueness

Uniqueness Score: -1.00%

Function 01550838 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462c56cb2b213d9a9cc07897e95185264b934b34d0a9dd4db52f56d89b621645
Instruction ID: 02a67ce5157831bf748aaa9ceac0d3eaa7e616475d58a3a7d9c7dcf88a7ce34a
Opcode Fuzzy Hash: 462c56cb2b213d9a9cc07897e95185264b934b34d0a9dd4db52f56d89b621645
Instruction Fuzzy Hash: B1E04F71905348AFCF11DBB4ED4674CBBB9EB4A210F5082A9D405D7785E6759A108B41

Uniqueness

Uniqueness Score: -1.00%

Function 059128D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb0ca4942d05c2da0d59a7d68ea59b5bd297bbe1ec83d1d14da21e76ed4e203
Instruction ID: 26f3d138bbd378d1866ed2905d52e3abadec1c6272f50d01f4f676454150b429
Opcode Fuzzy Hash: 1fb0ca4942d05c2da0d59a7d68ea59b5bd297bbe1ec83d1d14da21e76ed4e203
Instruction Fuzzy Hash: 09E01A78D0821CEFCB44DF99E4455ACFBB9EB48310F10C0EAEC4453351DA399A51EB95

Uniqueness

Uniqueness Score: -1.00%

Function 05912748 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb0ca4942d05c2da0d59a7d68ea59b5bd297bbe1ec83d1d14da21e76ed4e203
Instruction ID: a3eae203f146b71f4d91dca90202427ddae4dc542668269db17d373562d0fad4
Opcode Fuzzy Hash: 1fb0ca4942d05c2da0d59a7d68ea59b5bd297bbe1ec83d1d14da21e76ed4e203
Instruction Fuzzy Hash: F1E01A78D0820CEFCB44EF99E5445ADFBB9EB48310F14C0AAEC44A7351D635AA51EB84

Uniqueness

Uniqueness Score: -1.00%

Function 0658E930 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8300b98bf8a55257a55552171783ede17681920c24bc92575d22c29d05c6701
Instruction ID: da177ca8b75b8921e80908dfbd88a5fa8c3746184f9929c58605938e5e0c4806
Opcode Fuzzy Hash: b8300b98bf8a55257a55552171783ede17681920c24bc92575d22c29d05c6701
Instruction Fuzzy Hash: 62E08674908108EFC784DF94E4419BDBFB8EB45324F14D0A9E84867341C6719A41DB94

Uniqueness

Uniqueness Score: -1.00%

Function 05913920 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71663d1e4bcee1d3ef8e382bb29a1308ad442fc0ab65d7842655a08c63882d56
Instruction ID: bb930541ae1ad8784bcf5d1f0f0515845f563268d7ed2cf009a787dfebdca655
Opcode Fuzzy Hash: 71663d1e4bcee1d3ef8e382bb29a1308ad442fc0ab65d7842655a08c63882d56
Instruction Fuzzy Hash: 2DD0C770A4A24CEFC780CBA8A4407BA3BFCE302320F00A869EC0543260DB301A00E728

Uniqueness

Uniqueness Score: -1.00%

Function 05912928 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc1b9b923a0e4fdb3e319cf34be7c399f5764975620d88f2e4e21d8bfbc556a
Instruction ID: 1c8e66c88ec89f7d329a80f6b928f5b7acbcff2b11f8fefa0f8c6cfd62b403af
Opcode Fuzzy Hash: 5dc1b9b923a0e4fdb3e319cf34be7c399f5764975620d88f2e4e21d8bfbc556a
Instruction Fuzzy Hash: 78E01A34D04108EFCB44DF99E6416ACBBB8EB48310F10C0E9DC0953350CA315A41DB44

Uniqueness

Uniqueness Score: -1.00%

Function 05910E7C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c08b2b0c80f7b65b8098070bb4c4f1b262baf210ab665fe6e1f89c04bf80a4
Instruction ID: ab8abf85c90333607e2b6332215a663cf0a89e13b6c5a3c6dda1211102de756f
Opcode Fuzzy Hash: 95c08b2b0c80f7b65b8098070bb4c4f1b262baf210ab665fe6e1f89c04bf80a4
Instruction Fuzzy Hash: 35F0153180072EDBCF129F54C850ADAB731FF59304F108685E95A37250DB75AAD5DF80

Uniqueness

Uniqueness Score: -1.00%

Function 065879D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c0cb8f1909990041b5beb2200d37da313c02f2883720d336b89be0240ed155
Instruction ID: e83287f0b51bf3a4e2e7f4c0827b8bac6d95965089aa37903bce97d7e93e9a1b
Opcode Fuzzy Hash: 68c0cb8f1909990041b5beb2200d37da313c02f2883720d336b89be0240ed155
Instruction Fuzzy Hash: 8FE01A34D08108EFC744DB98D4416ACBBB4EB48210F20C0A9D85863351D6755A41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 05912FB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90cb90a8d7d13f7c8628b0c62c3def63b9e80758a00b639c8bba1f987207764
Instruction ID: 055039a13a9d2d01af742649ccf44be7568de07c6c84a3bc3d178bce700947fc
Opcode Fuzzy Hash: c90cb90a8d7d13f7c8628b0c62c3def63b9e80758a00b639c8bba1f987207764
Instruction Fuzzy Hash: 5DE0C23890810CDBCB04EF94E4409ACBBB8EB45300F20D4A8DC0813380CB316E52DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0658C850 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe159cd9b40916213682ccbe2e3772e9aaef4505193be37ddf2bad81da0c5ce6
Instruction ID: 203fc4dbc959ca5c25e604e41cc0e986fa7332a1932d85204164f700b6608d61
Opcode Fuzzy Hash: fe159cd9b40916213682ccbe2e3772e9aaef4505193be37ddf2bad81da0c5ce6
Instruction Fuzzy Hash: 0CE08C34D08108DFC744EB94E4449ACBBB4EB45300F20D0A9D80823341CA315E42DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05913588 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0358194c513d213a886c87ab9443154467eecee903763f1292c65fe62b7cf4
Instruction ID: d10efc5d0e6dd33e0193100f960a22fecf7d7f0b96f78172f71868a13e6ce254
Opcode Fuzzy Hash: 1d0358194c513d213a886c87ab9443154467eecee903763f1292c65fe62b7cf4
Instruction Fuzzy Hash: 76D0A77451910CDFC754CB94E444A79B7FCEB45715F10989CDC0D43351DA329E01D784

Uniqueness

Uniqueness Score: -1.00%

Function 05913930 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2524444117.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede484910514506ab36ec3094796004038e8197de13fc85a806c48f72edaacc8
Instruction ID: 294b2d668ab2a33bd3734e3f0d30f61c404508db9d801d8a613a6b70466f1e77
Opcode Fuzzy Hash: ede484910514506ab36ec3094796004038e8197de13fc85a806c48f72edaacc8
Instruction Fuzzy Hash: 7BD0127058E11CEFC795DAE8E545BBA7BFCE702621F106CA8EC0A13260DA751E40D759

Uniqueness

Uniqueness Score: -1.00%

Function 01550848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc94eeb39cd96c3b676d905d543ab5369305c628d11c2a5cec2a1d97e79b0c0
Instruction ID: af75feefc8be9e0a990d7eab2e92a80389ebeb7cbf8ea2f7804dca06c0cfed76
Opcode Fuzzy Hash: ccc94eeb39cd96c3b676d905d543ab5369305c628d11c2a5cec2a1d97e79b0c0
Instruction Fuzzy Hash: 5AD05E30A0030CEFCB04EFA9E94155DB7F9EB49614B1082A9D408D3354EB31AF109B80

Uniqueness

Uniqueness Score: -1.00%

Function 01550C98 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2483972846.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1550000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3e366412f11d1daf8ec1d3db725eb752382a8933564318db5a01517eaf6d18
Instruction ID: 636b3cb292cf2f3f2b004b79a5d54dd266bb43e0cf970c38021dc31329c52699
Opcode Fuzzy Hash: 9e3e366412f11d1daf8ec1d3db725eb752382a8933564318db5a01517eaf6d18
Instruction Fuzzy Hash: 43D0923C3406148F8748AF79E58892537A6BB8C61536089A4E909C7369EB31EC669B50

Uniqueness

Uniqueness Score: -1.00%

Function 0658CC58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5612317c8a9c1f8ea7964aa4c58733586ebba7884b065c02637333f6f19f3439
Instruction ID: 75ff1849d8d7062528d96241f3b6312b69cb52bf47e7bbba1145b94e01abc53a
Opcode Fuzzy Hash: 5612317c8a9c1f8ea7964aa4c58733586ebba7884b065c02637333f6f19f3439
Instruction Fuzzy Hash: 51C08C3005A2048EC2E43384758C770369CB306A02F002C14B00C118668AA61084C660

Uniqueness

Uniqueness Score: -1.00%

Function 0658FF10 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2552752014.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6570000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: notepad.exePID: 6960, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	222
Total number of Limit Nodes:	19

Executed Functions

Function 015FDDE8 Relevance: 3.6, Strings: 2, Instructions: 1081
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 015FE2E8
2, xrefs: 015FE928

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID: 2$$^q
API String ID: 0-1071376767
Opcode ID: b8ff5556093c06ca4cdf3841a531a168c5bc0996cca6b99af4537550e3e778e0
Instruction ID: d53dcb5f85ce76c0e98714f8e730034827896a3fac3509def0d73432ad027eae
Opcode Fuzzy Hash: b8ff5556093c06ca4cdf3841a531a168c5bc0996cca6b99af4537550e3e778e0
Instruction Fuzzy Hash: 1FC2B574E412298FCB64DF69C984A9DBBF6FB49300F1081EAD509AB365DB309E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0576EF50 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0576EFF2

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 3f2aa5bc01d5738e7403a6334b8a46b61bd6f01e776e8ba4751b5c8ef64956f6
Instruction ID: d21d15c09902f51d9b112682ad07a11d9125593de7dccc3dcfbe684d94cca8cf
Opcode Fuzzy Hash: 3f2aa5bc01d5738e7403a6334b8a46b61bd6f01e776e8ba4751b5c8ef64956f6
Instruction Fuzzy Hash: 3341E1B5D04258DFCB10CFA9D584AEEFBF4BB49310F14906AE455B7250C738AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0576EF58 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0576EFF2

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 308496fb9d62959a86ce2d12550f4314d115b069283cb1fae84c62d360b451ff
Instruction ID: 5f8350afa00102aa81fedf8ac2332a23c292d46eb75118e2131e702c1e7267da
Opcode Fuzzy Hash: 308496fb9d62959a86ce2d12550f4314d115b069283cb1fae84c62d360b451ff
Instruction Fuzzy Hash: 5341E0B5D04258DFCB10CFA9D584AEEFBF4BB49310F14906AE855B7250C738AA85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1560 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4acd1b65f00f4858e771ee13a7d9e83c18f749a256cf132efdec53036debd864
Instruction ID: b4ff5271bffcc1751d038b0d5b72504d1d6498d25c3388264008d3728653be10
Opcode Fuzzy Hash: 4acd1b65f00f4858e771ee13a7d9e83c18f749a256cf132efdec53036debd864
Instruction Fuzzy Hash: 31C169B5D05229CFDBA4CF69C844BD9BBF6BB49304F1485EAE50DA7250EB319A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 015F09E0 Relevance: 2.6, Strings: 2, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 015F0A8A
Te^q, xrefs: 015F0A77

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 65bb2f8bb147d0578e46335abc44163f92594ff4ce709e2c4286f44b94e3738c
Instruction ID: d890ede09af867699ff02a7e89fedde40769380ea19788763302963d0676842b
Opcode Fuzzy Hash: 65bb2f8bb147d0578e46335abc44163f92594ff4ce709e2c4286f44b94e3738c
Instruction Fuzzy Hash: 25317070E002099FCB18DFA9D5946AEBBF3BF88700F18446EE505EB3A5DA744D06CB80

Uniqueness

Uniqueness Score: -1.00%

Function 015F0A32 Relevance: 2.6, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 015F0A8A
Te^q, xrefs: 015F0A77

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: acbebce67a15f0558af6a7c8b6d19c04b3df7985a7d57964e9c280b333156619
Instruction ID: 9665e82139152b36f15e2cbc8ed87b244930351f54a97b0941bf378101007be4
Opcode Fuzzy Hash: acbebce67a15f0558af6a7c8b6d19c04b3df7985a7d57964e9c280b333156619
Instruction Fuzzy Hash: 18214F70B401099FCB14EFA9D558A6DBAE3BF94600F68056DE141EB3A5CAB05D45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA08C1 Relevance: 2.5, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4, xrefs: 05CA10C0
#, xrefs: 05CA08F1

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: #$4
API String ID: 0-353776824
Opcode ID: 99c1a814a203cb7c96aa24270ac29b1ba8235879d9c2379da4b804efcfc45304
Instruction ID: 5e16397ad2f1c026eb35568fb59285b5085c5919256de70f74de65665ccfb1bd
Opcode Fuzzy Hash: 99c1a814a203cb7c96aa24270ac29b1ba8235879d9c2379da4b804efcfc45304
Instruction Fuzzy Hash: A311B3B0902269DFDB60DF54DE98BEDBBB2BB05744F504499D209B7250C7769E84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0A68 Relevance: 2.5, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 05CA075E
@, xrefs: 05CA0A78

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: 1$@
API String ID: 0-1574762115
Opcode ID: 8492b41204d8b5298f125fdae729e797bc1fff648aa0734d9bfbb1e189ef378a
Instruction ID: bfb4a6a0b72b3ab91b52a1c17589db406590fd826354381e7209ccd1da2b8e80
Opcode Fuzzy Hash: 8492b41204d8b5298f125fdae729e797bc1fff648aa0734d9bfbb1e189ef378a
Instruction Fuzzy Hash: E801E275906259CFCB10CF14C888BEDBBB2FB06359F0488E6D61AB7200C7309A85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05CA07E4 Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05CA083E
D, xrefs: 05CA0815

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: $D
API String ID: 0-1196817373
Opcode ID: c55993062bda5078f546f3cb9903cf4faeedd1e27507c175d730b4be83065817
Instruction ID: 78a4ed59947b47cf29c23d95d3835b08ebbbe9d2399c1c89efa5aba8caf69766
Opcode Fuzzy Hash: c55993062bda5078f546f3cb9903cf4faeedd1e27507c175d730b4be83065817
Instruction Fuzzy Hash: B3F07A7580126ECFDB20CF14C948BE8BBF2BB09349F0089E6D219A2251D3759A85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05CA076D Relevance: 2.5, Strings: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F, xrefs: 05CA0778
%, xrefs: 05CA0BF6

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: %$F
API String ID: 0-2945472538
Opcode ID: 4b66994dc1a21ce29e6cb52476713562fee3f8f2aec71a3a776ea9a68d131881
Instruction ID: 1b83e9081b511350b1ee690fa659759371aa7ec8da2fb274e7ec3ddfe82c9139
Opcode Fuzzy Hash: 4b66994dc1a21ce29e6cb52476713562fee3f8f2aec71a3a776ea9a68d131881
Instruction Fuzzy Hash: 62E0E57584222DCFDB20CF21CA4CBEDBBB2BB0A349F105599810D63261D7784A8ACF40

Uniqueness

Uniqueness Score: -1.00%

Function 0576CB9F Relevance: 1.8, APIs: 1, Instructions: 265
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0576CE0F

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 91351dee42a709cd239461c05dda7ee1d2e3e0185acb5c875051d198858f2c5b
Instruction ID: 3c66a06b1871614df036828f0f5353586a1f8a175ac4ba74be16416ab776204b
Opcode Fuzzy Hash: 91351dee42a709cd239461c05dda7ee1d2e3e0185acb5c875051d198858f2c5b
Instruction Fuzzy Hash: C7A112B0D002189FDB11CFA9C885BEEBBB5BF09310F14916AE899B7240DB749985DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0576CBA8 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0576CE0F

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 36cdd3583006713e2b0819d5bf1b6c7366c76d7856115f1bc2fe8d763b39a606
Instruction ID: 1dc27dc9ba55a87e02853e975ec325e7374341c9f95b23cc5ad426c867ae74a2
Opcode Fuzzy Hash: 36cdd3583006713e2b0819d5bf1b6c7366c76d7856115f1bc2fe8d763b39a606
Instruction Fuzzy Hash: C8A113B0D002188FDB11CFA9C845BEEBBF1BF09310F14916AE899B7240DB749985DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0576D890 Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0576D968

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e634421f61c5b96b2296c9e7a73f33499998602517f7d18db79d327df1bf9bbb
Instruction ID: 8fe1b35c2e252e6a706ae39e679f3c5ced872844d958428440aa841135dd762a
Opcode Fuzzy Hash: e634421f61c5b96b2296c9e7a73f33499998602517f7d18db79d327df1bf9bbb
Instruction Fuzzy Hash: 8641BAB5D052589FCF10CFA9D984ADEFBF1FB49310F24902AE819B7210D738AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0576D898 Relevance: 1.6, APIs: 1, Instructions: 115
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0576D968

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dcea9c1b01033c4971255e46dfd5ea01d46714a4c19c8d8ba867c75a9b631b07
Instruction ID: b73b5271d1f9633931634a9aed2d9fbef3db255136f746bb321ae3d4fb7bcc40
Opcode Fuzzy Hash: dcea9c1b01033c4971255e46dfd5ea01d46714a4c19c8d8ba867c75a9b631b07
Instruction Fuzzy Hash: 1041A8B5D052589FCF10CFA9D984AEEFBF1FB49310F20902AE819B7210D735AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0576D5D0 Relevance: 1.6, APIs: 1, Instructions: 113
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0576D682

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 226b1b9f4592498c7f70444a99e35d403ec6772e84b26ffadeba0f8134b65f67
Instruction ID: 63193fc09af0061487c1ca5b4d9ebe0b3c9834390645345cbcaf06c0e2071e9a
Opcode Fuzzy Hash: 226b1b9f4592498c7f70444a99e35d403ec6772e84b26ffadeba0f8134b65f67
Instruction Fuzzy Hash: 0641BAB5E01258DFCF10DFA9D984A9EFBB5BB59320F10902AE819BB210D735A941CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0576D5D8 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0576D682

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e05b5436e29863b18d23df9e8c3bd5bba5f8fafbc7ccbacc97d5b477ab9f014b
Instruction ID: d88a6810383b6474a4ce23034373e66dfb6d5edd490d88d9c927944e0ebdff46
Opcode Fuzzy Hash: e05b5436e29863b18d23df9e8c3bd5bba5f8fafbc7ccbacc97d5b477ab9f014b
Instruction Fuzzy Hash: 0F319AB5D04258DFCF10CFA9D980ADEFBB5BB59310F10942AE819BB210D735A945CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0576D593 Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0576D682

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bcbbb452999881b810ffc63f4f4352cb5a590c0abeec2835d68f9cc9cec522df
Instruction ID: dd4908d64233805d9d5a0c0c7c6ef8c7aa508d8596b2a4efc0b1b5f64e184743
Opcode Fuzzy Hash: bcbbb452999881b810ffc63f4f4352cb5a590c0abeec2835d68f9cc9cec522df
Instruction Fuzzy Hash: 1931B0B5E05209DFCF10DFA9E884AEEBBB1BB49314F10A029E815B7220D735A951DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0576CF53 Relevance: 1.6, APIs: 1, Instructions: 95threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0576D007

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a9db1b4d5cd049dd1e5ff2c27e46dd1f9a170fb89d6bd19bf6f876360145a4f6
Instruction ID: d95452d26cc54c4f6632f9ca01fd6707a14e7a769c7dd527dd9b530e31570c56
Opcode Fuzzy Hash: a9db1b4d5cd049dd1e5ff2c27e46dd1f9a170fb89d6bd19bf6f876360145a4f6
Instruction Fuzzy Hash: 9A41BEB5D012589FCB10DFA9D984AEEFBF1BF49310F14802AE415B7250D738A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0576CF58 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0576D007

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 403bfcb3167d766e21b2e5e2b342413d3886861f175795ff89d17a70b2453de2
Instruction ID: d929ad4d5e3204012cea48e47e15562cb327bb67b4960df4dd8d9f03f4392154
Opcode Fuzzy Hash: 403bfcb3167d766e21b2e5e2b342413d3886861f175795ff89d17a70b2453de2
Instruction Fuzzy Hash: 5331BEB5D012589FCB10CFA9D584AEEFBF1BB49310F14802AE415B7250D738A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0576DC2B Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0576DCAE

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 84e0624392a582dfaa93a73a047af7ed8b0429ee1480065acef57418d50dad04
Instruction ID: 071e86f177066111fbb8778994af11c27f9a63423e99e68a4c81287c837e524c
Opcode Fuzzy Hash: 84e0624392a582dfaa93a73a047af7ed8b0429ee1480065acef57418d50dad04
Instruction Fuzzy Hash: 9C31C9B4D002189FCB10CFAAD981ADEFBB5AB49320F14902AE815B7310C774A941CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0576DC30 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0576DCAE

Memory Dump Source

Source File: 00000006.00000002.2648883905.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_notepad.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c28e09c23e47c690198482435c51dbe04a45128f6e47a09b7f921f29b97770a8
Instruction ID: df8f1bc40490072f0002cde594e4b59a73d04158ec1c70e9aae186f0a447c643
Opcode Fuzzy Hash: c28e09c23e47c690198482435c51dbe04a45128f6e47a09b7f921f29b97770a8
Instruction Fuzzy Hash: 8A31AAB4D012589FCB14CFAAD984ADEFBB5BF49320F14942AE815B7310C775A941CF98

Uniqueness

Uniqueness Score: -1.00%

Function 015F0B59 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

<duq, xrefs: 015F0C44

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID: <duq
API String ID: 0-2704095200
Opcode ID: 961c584e910ae366aba2972967c1b0a50f06b92e6f3ac855078474ac1d2d3144
Instruction ID: 98e08a89f183e227029ce41493c6df1c038b7f2bbd3d78aec071f4d21481f617
Opcode Fuzzy Hash: 961c584e910ae366aba2972967c1b0a50f06b92e6f3ac855078474ac1d2d3144
Instruction Fuzzy Hash: 0B519635A00249DFCB45DF98D99099DBBF2FF48314B288499E915EB366C731EC52CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05CA04B7 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4, xrefs: 05CA10C0

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: b0a82d86cab06e8cbc39277fd09cb35c4337813ebcb5b9aec371d06af5c2919e
Instruction ID: cfb937dba88f2872bfe673b5b7ad4b455430f4c3fcaac408c944ec7a10a0f3a6
Opcode Fuzzy Hash: b0a82d86cab06e8cbc39277fd09cb35c4337813ebcb5b9aec371d06af5c2919e
Instruction Fuzzy Hash: C011C570902259DFDB21DF59CD48BEABBF2BB49744F148496E209B7251D3325E81CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0F57 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

H, xrefs: 05CA0F65

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 3e9e086ae794ac7858123e1c33a740070c37249e5fc377849a2a65f2f6f27fb3
Instruction ID: bb284c1023c8aaca76cbbc97b6890a3dd0128d40f7b17060cf746905e147a8df
Opcode Fuzzy Hash: 3e9e086ae794ac7858123e1c33a740070c37249e5fc377849a2a65f2f6f27fb3
Instruction Fuzzy Hash: 8C01D271801269DFDB20CF64C858BEDBBB2BB09349F0088D6E209B2250C7754A94DF54

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0434 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

,, xrefs: 05CA0442

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 5a44a6293055a914531e10208e738404e3dfdc35fae07f14dd638b0071b2ec9d
Instruction ID: 7269fd5a1f6f2bd0bd34ab8c7baf336ded433f9cfbbfa8fc27e65f1b93034a43
Opcode Fuzzy Hash: 5a44a6293055a914531e10208e738404e3dfdc35fae07f14dd638b0071b2ec9d
Instruction Fuzzy Hash: 7301E471802269DFDB20CFA4C958BEDBBB2BB09349F0088D6E209B3250C3754B94DF50

Uniqueness

Uniqueness Score: -1.00%

Function 015F0CC7 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

8bq, xrefs: 015F0CE5

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: f2f963f1f8e8d46d9b414e4e1a1eb6a36701ec2e0426d9b01da8b7a064915494
Instruction ID: 3dfa148ed92c2d6a9fd7974f6746e398e0de39bab113856a9ede51c54e754cb3
Opcode Fuzzy Hash: f2f963f1f8e8d46d9b414e4e1a1eb6a36701ec2e0426d9b01da8b7a064915494
Instruction Fuzzy Hash: 69F089346812089FC346DB78E424BAD77F6EF89345B14407ED5458726ACB309C098F91

Uniqueness

Uniqueness Score: -1.00%

Function 05CA05D8 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

4, xrefs: 05CA10C0

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: a7c6d92e9ad734bb162c70fe75524ddbd7065159b7f8fe74b80467fd466180b5
Instruction ID: 08cba61efe927594e769c674a392c7937d2e751cbfdd76cf57c045d403b04411
Opcode Fuzzy Hash: a7c6d92e9ad734bb162c70fe75524ddbd7065159b7f8fe74b80467fd466180b5
Instruction Fuzzy Hash: 2FF0B771902259DFDB11DF54DE58BEEBBB2BB09744F104495E209B7240C3725E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0C7B Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

1, xrefs: 05CA075E

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 2bdd9e51163fad2eaeff18175d70d664ffc5b2147eb53f26290698f24ee86fdc
Instruction ID: 1aff7a74ad4d9584dd5cfd0e6c0ec401cc59e56ee6098e7fa2bfbbcb57c4cf8c
Opcode Fuzzy Hash: 2bdd9e51163fad2eaeff18175d70d664ffc5b2147eb53f26290698f24ee86fdc
Instruction Fuzzy Hash: 56F0D471D0521DCFCB65DF25C858BEDBBB2BB49344F00599A850AB7261DB305E85CF05

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0715 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

1, xrefs: 05CA075E

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 907de5a156aa499d9c8e32784803ebee0c3334bd77e9989a4686dc46c921ac09
Instruction ID: 4d0549915b7cd52847261bee5f9613a0067d1686b134e7b33733adf88eb881eb
Opcode Fuzzy Hash: 907de5a156aa499d9c8e32784803ebee0c3334bd77e9989a4686dc46c921ac09
Instruction Fuzzy Hash: B0E0C2B49012188FCB65DF25D898AECBBB2BB89744F10459A940AA7265DB309E84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0318 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

A, xrefs: 05CA034F

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: ece5d38794c053a473eefd5b63f1376d7527a0ea7dbbc52bf6c39a9b73f37382
Instruction ID: 2e6f78675318b8e92b63c3ac5aa1b51c4fa3239bd7e9086696e65962e6ebf2c6
Opcode Fuzzy Hash: ece5d38794c053a473eefd5b63f1376d7527a0ea7dbbc52bf6c39a9b73f37382
Instruction Fuzzy Hash: 3BE0B67594431A9FDB20CF60CC09BEDBBB2BB14309F004595E609B6291D3745A85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0205 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

!, xrefs: 05CA0227

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: a08fcf9451a9c73219ba9cd69e6a4a842fd4076d1b16858fd7627c39e367a874
Instruction ID: 26c867953db1ac26d0533a37211ebd03681700dd4e3e54faa482ea9fb7c70a4b
Opcode Fuzzy Hash: a08fcf9451a9c73219ba9cd69e6a4a842fd4076d1b16858fd7627c39e367a874
Instruction Fuzzy Hash: D2D0C97494112D8BDB60EFA5C9487D9BAF1BB18344F1044C9840CA2301D6700E858F40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1550 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64772c45c1e3dcef520039e7481ab99e012d7812de703f6bf1ee2477294e521
Instruction ID: 8f73590b9d4059fdda5adcf7346a5383aa1211e20cf8ff07e0b0d654cb318cdb
Opcode Fuzzy Hash: c64772c45c1e3dcef520039e7481ab99e012d7812de703f6bf1ee2477294e521
Instruction Fuzzy Hash: 30B189B5D05229CFDBA4CF69C844BD9BBF6BB49304F0485EAE40DA7250EB319A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1601 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ef6d52254391b32dd6d465b6c86431a7b718d7cc98101cbe1df0ed33bd575d
Instruction ID: 4cd0342d7c5d931f86569791fb1d90a60d0973d5db9f4e53be752ac15e41c276
Opcode Fuzzy Hash: 66ef6d52254391b32dd6d465b6c86431a7b718d7cc98101cbe1df0ed33bd575d
Instruction Fuzzy Hash: 25B18AB5D05229CFDB65CF69CC44BD9BBB6BB49304F1485EAE80DA7250EB309A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1822 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251e96be17ac283972c4f7da51e8aec2cb006c0662737fe32dac297de978988d
Instruction ID: 41c65075229982db977e3b9bf57852c7096f7ed49d8a8c9ce2766c9384938d23
Opcode Fuzzy Hash: 251e96be17ac283972c4f7da51e8aec2cb006c0662737fe32dac297de978988d
Instruction Fuzzy Hash: 31B16975D05229CFDBA4CF69C844BD9BBF6BB49304F1485EAE40DA7250EB319A84CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1B25 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7e06dcd099b777d509ad50a57906900d1c948845bb1b247ce517c4a4e9ad3c
Instruction ID: 626b45a4f65995ce3b3beeb5b9a5159c4815784377e7b6b08db31d782bbdd6db
Opcode Fuzzy Hash: 0c7e06dcd099b777d509ad50a57906900d1c948845bb1b247ce517c4a4e9ad3c
Instruction Fuzzy Hash: C8B168B5D05229CFDB65CF69C844BD9BBB6BB49304F0485EAE40DA7251EB319A84CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05CA18B0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a872fdc6c11d1ed3996ab6f5ab58eef668d169f8c6a0399979baea22b154f19a
Instruction ID: 72b0ee9c7c6c6c1ef947f1b16c8860efbe044d7bb5b0e3f2a8246b2458884ff3
Opcode Fuzzy Hash: a872fdc6c11d1ed3996ab6f5ab58eef668d169f8c6a0399979baea22b154f19a
Instruction Fuzzy Hash: 29B178B5D05229CFDB61CF69C844BD9BBB6BB49304F0486EAE50DA3250EB309A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1AB0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b20c47810ddc151d48a12d894879045fe8db8c5ffee95ff3e5b15ce0ffbf53b
Instruction ID: a5e697b473335eacad9384100cec49efa7b13a961c37c31a544a009984990f3f
Opcode Fuzzy Hash: 3b20c47810ddc151d48a12d894879045fe8db8c5ffee95ff3e5b15ce0ffbf53b
Instruction Fuzzy Hash: 7EB179B5D05229CFDB61CF69CC44BD9BBB6BB49304F1486EAE40DA3250EB319A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1981 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43741b04fecf42084aadc029a9bea4ff850e384d3bd1e8aa56623bbadb0c8936
Instruction ID: 848c0ce58b5c23f7707c5f008c5bee49b9a507ee41d98697d2b18ec2ecb8c57d
Opcode Fuzzy Hash: 43741b04fecf42084aadc029a9bea4ff850e384d3bd1e8aa56623bbadb0c8936
Instruction Fuzzy Hash: CBB179B5D05229CFDB65CF69CC44BD9BBB6BB49304F0486EAE40DA7251EB319A84CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1907 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fd7d760599d667350a56749b0d14b1afdc2f2def635ccdc72794dbc4e0695a
Instruction ID: 9da435b920e83ac4665fe9ad9cdf5e20316d28e738c8da76c714dcef0e0500b5
Opcode Fuzzy Hash: a8fd7d760599d667350a56749b0d14b1afdc2f2def635ccdc72794dbc4e0695a
Instruction Fuzzy Hash: EEB178B5D05229CFDBA5CF69C844BD9BBF6BB49304F0485EAE40DA7250EB319A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1789 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b20f5f45c0f13a0784740b14d3771f874dc3000571562b20e7ae590bb74a6a
Instruction ID: 6e2e978d162c2579bcaade8d8b2fc7d2a1f04e6649e64072e3aa82beb2198f50
Opcode Fuzzy Hash: 44b20f5f45c0f13a0784740b14d3771f874dc3000571562b20e7ae590bb74a6a
Instruction Fuzzy Hash: 93B178B5D05229CFDBA5CF69C844BD9BBF6BB49304F0485EAE40DA7250EB319A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1723 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6edd2bd06b9f9993c47bd6cff27da643dd04b8e88b95427ae09c27926f2fef
Instruction ID: d2f7f4c2ef8b697d6f2c80a8b469970da3fd5b4c4886a4b648dd5825d418941f
Opcode Fuzzy Hash: 3c6edd2bd06b9f9993c47bd6cff27da643dd04b8e88b95427ae09c27926f2fef
Instruction Fuzzy Hash: 13A178B5D05229CFDBA5CF69C844BD9BBB6BB49304F0485EAE40DA3251EB319A84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 015F0881 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2129505e8142b2bdd3806bc4775d41217a29feb16e683697ed2b65828361f67c
Instruction ID: 2d7da3af24da46de708479e9744c106144c45f161301ae4fc6d8df287b38c7ff
Opcode Fuzzy Hash: 2129505e8142b2bdd3806bc4775d41217a29feb16e683697ed2b65828361f67c
Instruction Fuzzy Hash: 204180B4A0124A8FCB02DF68C99069EFBF2FF85300B04866AD505DB356EB359806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 015F08A8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5006a13478ecc3c942978648096f85fec8981d6031f58276e0ea34d971e683de
Instruction ID: 90fa7cf7421a977de881d66ad1068082ab40590e598827224d90c94722131ba9
Opcode Fuzzy Hash: 5006a13478ecc3c942978648096f85fec8981d6031f58276e0ea34d971e683de
Instruction Fuzzy Hash: 2D3143B4A0120A8FCB01DF69D950A9EF7F2FF84300B04C62AD915AB359EB71E945CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0146D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2565579560.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_146d000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae19e93860801d6e3c73613cba0c3b28345fabcf0e4d2b1d05c6e0676b3a229
Instruction ID: 043a4929484ce94ce96f0592ef66d3d0a643a42db8d5c0f8b446f7a508c4edad
Opcode Fuzzy Hash: 2ae19e93860801d6e3c73613cba0c3b28345fabcf0e4d2b1d05c6e0676b3a229
Instruction Fuzzy Hash: B02133B1A04240DFCB11DF48D984B27BFA9EB8431CF24C56AE9490B362C336C407C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 0146D006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2565579560.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_146d000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addf5f2a0c7523cbeff6f67e5d28f757ff817f341b91480376cfac1d539a6ca2
Instruction ID: ba7f9624dcaae4cb2a7bd6c62396f40ab913ceb3b112d5055012a3ac9a15b284
Opcode Fuzzy Hash: addf5f2a0c7523cbeff6f67e5d28f757ff817f341b91480376cfac1d539a6ca2
Instruction Fuzzy Hash: 3B2180755093808FDB13CF24D994716BF71EB86218F29C1DBD8858B667C33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 015FC6F8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41e1063f805102923088d43ba3a039634f960e755341d4e57186fdac377fbd9
Instruction ID: c6bfda730627505c3ed3575ce23f2be0a14a80aae68f18a419833e74ca238f4d
Opcode Fuzzy Hash: f41e1063f805102923088d43ba3a039634f960e755341d4e57186fdac377fbd9
Instruction Fuzzy Hash: 1821367094620CDFDB00DFA8C448AADBBF5FB49304F2094BED505AB252DB759A44CF01

Uniqueness

Uniqueness Score: -1.00%

Function 05CA278B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d462ab763b3feb90ad0cd68e033f3759e8585fd4c2a4f687d06411d6b8d10c42
Instruction ID: ccc798b92f35f7a51c1a171a24c0d9d1661bb92458487a98557f4eaa54ab9ed0
Opcode Fuzzy Hash: d462ab763b3feb90ad0cd68e033f3759e8585fd4c2a4f687d06411d6b8d10c42
Instruction Fuzzy Hash: 52014C7A904108EFCB01DF94D880AADBFB5EB58314F24C5AAEC0997351D6369B51EB80

Uniqueness

Uniqueness Score: -1.00%

Function 05CA27E7 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893bfe07fc8a214da4c4134a500029b0a641965cf3b5181774d27b7d61c1b56a
Instruction ID: 613adb618c8e3cb05e54445310ca35ac77fee415c2ef23c4a91ae7dfc1554501
Opcode Fuzzy Hash: 893bfe07fc8a214da4c4134a500029b0a641965cf3b5181774d27b7d61c1b56a
Instruction Fuzzy Hash: 7301E93A90410DEFCB41CF94D8809ADBFB6EB48314F14C499FD59A7351D7329A61EB40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA14EB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51922e019853bd79cc805731ae9196e188599811929d9227dd284c6f1539a39e
Instruction ID: 51a1b0e1d62c43ffde65842ba4fee92b7587fcab9526756d31a861f2466fe554
Opcode Fuzzy Hash: 51922e019853bd79cc805731ae9196e188599811929d9227dd284c6f1539a39e
Instruction Fuzzy Hash: 21F0193280020AEBCF01DF99D8009EEBB75FF89325F04C519E95927210D731A6A5DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05CA035E Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c78d026250f55933596a5768a90c1ebe670a45b22467e89322d5adde527716
Instruction ID: 66a037d84efc8bb3225fb33bf7dfed328657e2f9462960e39d7409a5138c2f85
Opcode Fuzzy Hash: 67c78d026250f55933596a5768a90c1ebe670a45b22467e89322d5adde527716
Instruction Fuzzy Hash: 74010471901269DFDB24DF65C858BECBBB2BB09744F0088DAD20AB7250CB314E94CF14

Uniqueness

Uniqueness Score: -1.00%

Function 05CA14F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fe36563129bb63d095bf25fbd269705df5760aae223b76b7081aa0bfcae355
Instruction ID: a3d84ebbb7850aa4d4d3c3dc1ce298669fbd5a9fbd901604b2ef6f21216b6b8f
Opcode Fuzzy Hash: 01fe36563129bb63d095bf25fbd269705df5760aae223b76b7081aa0bfcae355
Instruction Fuzzy Hash: ABF0E73290020AEFCF01DFD9D8009EEBB75FF89325F14C519E95927210D731A6A6DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0B47 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c428092b6619df3b53ee3965b266200e0781f680ef81c61f14ed691b8069ae31
Instruction ID: 1994ce4d1be47d49738a61c1be5454ae3e210fc882d1dc111db6500ea02f1704
Opcode Fuzzy Hash: c428092b6619df3b53ee3965b266200e0781f680ef81c61f14ed691b8069ae31
Instruction Fuzzy Hash: F501B275942268DFDB20CF54C988FE9BBB2FB09318F1484DAE609A7251D3369E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA28C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fa3fa81ac4187cee6715fe995b99f7152b1e9bea059fb10b98c0eaa88b77a0
Instruction ID: f3e38674390678523064dcdc385302a2d4563d224aa2117c87f7210627a86dfe
Opcode Fuzzy Hash: 01fa3fa81ac4187cee6715fe995b99f7152b1e9bea059fb10b98c0eaa88b77a0
Instruction Fuzzy Hash: 19F0E575D08208EFC750DFA4C4455ACBFB4EF59304F10C4EAE80493361D6358B42EB41

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1EF7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2fde9e3ae690cbdbd8fe065a860118970f7532f3a9cc1202c418d8baee0c41
Instruction ID: c7623adf2e924503d691c11b098b6cb1c201bef6ce491f3191aa37d58d311eb5
Opcode Fuzzy Hash: 2c2fde9e3ae690cbdbd8fe065a860118970f7532f3a9cc1202c418d8baee0c41
Instruction Fuzzy Hash: 6FF01C75D04148EFCB45DF94D841AACBFB5EB48314F14C4AAED1456351D7329A51EF80

Uniqueness

Uniqueness Score: -1.00%

Function 05CA1F77 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0beb06fec8856fbad718a07fb6f6c56da2246ca798c566f0f105156acd7b35f
Instruction ID: 245e8e8191a45066ee494e19597e8a59263fac2bca9d923ee420a525c2eabac2
Opcode Fuzzy Hash: f0beb06fec8856fbad718a07fb6f6c56da2246ca798c566f0f105156acd7b35f
Instruction Fuzzy Hash: 6CF03979908149EFCB01CF84D840AACBFB1FB48315F18C5AAEC1457251C7328B51EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CA27F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1975159c95685e472ecad453f740ddd86dfc856d12e399789cecda1a521aff8
Instruction ID: f21a9e5614cd2c8fa21c809b71c5d390188b6f1247480732403bd28518b2f1d0
Opcode Fuzzy Hash: d1975159c95685e472ecad453f740ddd86dfc856d12e399789cecda1a521aff8
Instruction Fuzzy Hash: 87F0153A908208EFCB05CF94D840AACBFB5EB48314F10C4A9FC5456261C6329A61EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA2798 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b127f5563094242857d9885daaf2ec39f86825809c130eeab7ce4b1215e01ab
Instruction ID: 9c6c97c72384cc7c4cde22a0fc1d9351802c274f4183c574031f98e1d23a365c
Opcode Fuzzy Hash: 8b127f5563094242857d9885daaf2ec39f86825809c130eeab7ce4b1215e01ab
Instruction Fuzzy Hash: 9EF01539904208EFCB01CF98D8409ACBBB5FB48314F10C4A9EC0997360D7329A61EB41

Uniqueness

Uniqueness Score: -1.00%

Function 015F0838 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ea482bc4b1ef60ed327813ecea27a041e3abcf43a37ebd2c82cafe6c301b09
Instruction ID: 84a8c91fcf9630b501eb557e45f8805635f277b66a85880e630efbdc8cc26eab
Opcode Fuzzy Hash: 29ea482bc4b1ef60ed327813ecea27a041e3abcf43a37ebd2c82cafe6c301b09
Instruction Fuzzy Hash: E6E068708063489FC741CFB8E8500ACBFB5EF8220470081DFD444D7221D7310E018F01

Uniqueness

Uniqueness Score: -1.00%

Function 05CA2FE3 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6149bb4eb5c4b7aa59d5f9cb8deb15cfdd50899edad40f30ca5b539ac35193d
Instruction ID: 3e714c8eab37ce871a5c036972ed0f75c065bc29a858b0ce3acc37d576f4a585
Opcode Fuzzy Hash: a6149bb4eb5c4b7aa59d5f9cb8deb15cfdd50899edad40f30ca5b539ac35193d
Instruction Fuzzy Hash: A0E0263DD0D028CBCB04DF94D8801BCBFB5EB45309F209AA9D80957310C7318E02DB00

Uniqueness

Uniqueness Score: -1.00%

Function 05CA2743 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec790d38976304d801de3cb3120dcfe66f24777258f692939ea573c9deb426c
Instruction ID: 695ffbf99783ea31e8dffe9935f6b4544b0d56c944565a749f423a76f0eb1c4f
Opcode Fuzzy Hash: fec790d38976304d801de3cb3120dcfe66f24777258f692939ea573c9deb426c
Instruction Fuzzy Hash: 2AE09A78D08208EFCB40DF98D980AACFFB4EB48304F10C4AAEC04A7350D631AB41EB80

Uniqueness

Uniqueness Score: -1.00%

Function 05CA2921 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98abb127d60eb10e8328de5faab309547f3c5e5ee10f114c1e14a25bbed9bfca
Instruction ID: 735d64fce1684e6df20369fc475d7b32710a386f5e7ba12edc710fbc9cb796be
Opcode Fuzzy Hash: 98abb127d60eb10e8328de5faab309547f3c5e5ee10f114c1e14a25bbed9bfca
Instruction Fuzzy Hash: 43E01A79E04108EFC744DFA8D4816ACFBF4EB58318F1084A9D81897350DA319A41DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA28D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf1af9673656e6d4b588eed0a90871337a310e85c78fc34b726ae9b1aa9234f
Instruction ID: 00e3b519c86566f09b99bbecd7cdd58c404cef1651b8ee33aa91f98ab76cba3b
Opcode Fuzzy Hash: 0bf1af9673656e6d4b588eed0a90871337a310e85c78fc34b726ae9b1aa9234f
Instruction Fuzzy Hash: 79E06539908208EFCB10CF98D4405ACBFB4EB48304F10C0AAE80453350CA359A41EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA2748 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf1af9673656e6d4b588eed0a90871337a310e85c78fc34b726ae9b1aa9234f
Instruction ID: f8eb696a32a5ee88c10f7d20a40037cd83b55c6a92fbfb064d925adbee234367
Opcode Fuzzy Hash: 0bf1af9673656e6d4b588eed0a90871337a310e85c78fc34b726ae9b1aa9234f
Instruction Fuzzy Hash: 4BE01A78D08208EFCB45DF98D5409ACFFB5EB48314F10C4AAEC44A7351D6359B51EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA0E7C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447d0b04ac84a5edbde1f9e0f857675707aa9b0c1043852dbd7ad3ec8e4521f1
Instruction ID: c0cdfca526e89078ace10a2e38eb1cffef87c14132fb7ca12d7551a4625b9fea
Opcode Fuzzy Hash: 447d0b04ac84a5edbde1f9e0f857675707aa9b0c1043852dbd7ad3ec8e4521f1
Instruction Fuzzy Hash: B6F0153180061EDBCF129F54CC04ADABB32FF59304F108645E94A77220DB70AA96DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05CA2928 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb45e71b793db752f9784ab2097ca65103c708029b51d422628e9e7fde610f1
Instruction ID: b85c3b000da94cc418834aa5019d6c0ad8c3e46b18f2eae61a1645fe5ffb1550
Opcode Fuzzy Hash: cdb45e71b793db752f9784ab2097ca65103c708029b51d422628e9e7fde610f1
Instruction Fuzzy Hash: E6E09A78D05108EFC744DFA9D5416ACBBB5EB49314F1085A9D80957351DA315A41DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA2FB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af656de706b7731fd570ba9fd57ef431b7aa4fc6283a79e8f991c0a52cd5a04d
Instruction ID: 69aaf3df00f06c30e848be365248649da419f08d48cd7bae22142297fde8c37c
Opcode Fuzzy Hash: af656de706b7731fd570ba9fd57ef431b7aa4fc6283a79e8f991c0a52cd5a04d
Instruction Fuzzy Hash: 50E0C238909118DBC704DF94E8405ACBFB4EB45308F2094A9D80817350CB31AE42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CA3583 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d2b403f60f02a562ebd877e3ee87839e4116e24163588ef5703c6cc6c15926
Instruction ID: 0db0120c77dfdfac237e4aebb72b2c5df3acc16a64fe988f6f4bff90e23032e3
Opcode Fuzzy Hash: 93d2b403f60f02a562ebd877e3ee87839e4116e24163588ef5703c6cc6c15926
Instruction Fuzzy Hash: 24D02E34509108EFC300CB88D840A78BBFCEB46209F10A8A8AC0843310DA329E01EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA3588 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85511f0c72307b2f636f659b5a9ac738783211fd2b72160a4a9bca61dc768574
Instruction ID: ee1bff7d166db8d9f1a7a0cdbeb1760fee3e8d0f168b31a2ab7798487259787f
Opcode Fuzzy Hash: 85511f0c72307b2f636f659b5a9ac738783211fd2b72160a4a9bca61dc768574
Instruction Fuzzy Hash: 9DD0A774509108DFC754CBD8D454A69FBFCEB45719F10989CD80947351DA329E01DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05CA392B Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf7005a628c90d74d41a1826d6870cda25066040f68717d7012cf8af2942696
Instruction ID: 62513d7bcb4c6bf2886ed7a934c82bb05d0852d6a0cb8fcdd4f51ecd642e848b
Opcode Fuzzy Hash: 1cf7005a628c90d74d41a1826d6870cda25066040f68717d7012cf8af2942696
Instruction Fuzzy Hash: FAD0A73164A14DEBC740C6A8D4117697BACE702A19F102C58E80453220CA311A40D296

Uniqueness

Uniqueness Score: -1.00%

Function 015F0848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80dac75d0005513cf1f52565deb716bdfdd991841b28725f3de18b8d7536b38
Instruction ID: c517dc4a0d6b6f0354a8ba9eef1d42e406f827fd4927c8adddb51e49b1244b31
Opcode Fuzzy Hash: d80dac75d0005513cf1f52565deb716bdfdd991841b28725f3de18b8d7536b38
Instruction Fuzzy Hash: C8D0127090120DEF8B40DFA9E90055DB7B9EB45654B1041A9D408D7224DA315E009B41

Uniqueness

Uniqueness Score: -1.00%

Function 05CA3930 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae01bdeab677a33f91df2985d224f1d46c8ea589b1dabdaf795c488bce200ba
Instruction ID: 210895386904472a7622c990569f7f1e9f29ba760cd57ebb2587246787a74b57
Opcode Fuzzy Hash: 9ae01bdeab677a33f91df2985d224f1d46c8ea589b1dabdaf795c488bce200ba
Instruction Fuzzy Hash: 3ED0223058E14DEFC780CAF8D401BAA7FECE702A29F102CA8E80813220CA310F00D392

Uniqueness

Uniqueness Score: -1.00%

Function 015F0C98 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2572818765.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15f0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d7169d44d9a937986806d0ba63ef93b07355bad3915cf5201ba31b1bb276eb
Instruction ID: ec2089082f08e3b424361ab8ff9f98095a34f16dc3c04db8a06962387b37149d
Opcode Fuzzy Hash: 97d7169d44d9a937986806d0ba63ef93b07355bad3915cf5201ba31b1bb276eb
Instruction Fuzzy Hash: A3D0C7383405089FC745AF78E55892537E7BB4C61535049A5E90DC733DDA31EC159B51

Uniqueness

Uniqueness Score: -1.00%

Function 05CA38D5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2650508434.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ca0000_notepad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480de1db5d3f9b32601536dea0335c63d9b937c9e03eb63d1a5f3ee93a441927
Instruction ID: 403ff864f6817f661e4c347683d93447cf85134d2591a8db942d5e65be796ecb
Opcode Fuzzy Hash: 480de1db5d3f9b32601536dea0335c63d9b937c9e03eb63d1a5f3ee93a441927
Instruction Fuzzy Hash: 71B02B225CE0CFC38700C1B1A43097B3E1AE383C187102C85D80D1351055010B004581

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1832, Parent PID: 2516COMMON

Executed Functions

Function 033490F8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c239274b8c41b80eaaf0a3a5b678c3f82c83158ad97a4de3d0fd26dabd423d2
Instruction ID: c9b8471973d214414aa2a5fe8bbca6609a9179b7af3d26f9d0089ccc629af0fa
Opcode Fuzzy Hash: 4c239274b8c41b80eaaf0a3a5b678c3f82c83158ad97a4de3d0fd26dabd423d2
Instruction Fuzzy Hash: EF020974A002199FCB05CF98D984AAEFBF2FF48310F298559E805AB365D735ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03349688 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6bb723857ceed865f9274800b5eec28d6752cdc7620acefd28a938d7a76e9c
Instruction ID: 9f427ee173a26e8ddeb6c5d76d852e81d45eb4c3b4c152c5c269453a88df463d
Opcode Fuzzy Hash: da6bb723857ceed865f9274800b5eec28d6752cdc7620acefd28a938d7a76e9c
Instruction Fuzzy Hash: 6D71C135A053489FCB01DF68D8909DEFFF1EF4A214B198196E444AB322D734EC49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03346C00 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d39ba4277ae2a1c14b9b20a006e9e861e4c903315856027ca46223b773467b
Instruction ID: 82591cbab207ff3080a4f0c8a40d53f8cc2579c6a3056f14675079dab94d8174
Opcode Fuzzy Hash: f8d39ba4277ae2a1c14b9b20a006e9e861e4c903315856027ca46223b773467b
Instruction Fuzzy Hash: 73512B75A01208DFCB14CF69D985A9EFBF5EF89310F1980A9E409AB361D735EC85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 07A018D5 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2370809854.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009b80fb17bdd7fad53be843cc98e8228006ca27b6ba611ac030255f5e735205
Instruction ID: 487fc9c043bfa4e55d6ce395a62ccaa86581a4724be6e75fb12ccb011f1ce5b8
Opcode Fuzzy Hash: 009b80fb17bdd7fad53be843cc98e8228006ca27b6ba611ac030255f5e735205
Instruction Fuzzy Hash: C341ADF1B402198BC72457BCE915AEEBFE2AFD1354B008CBAE5119B391DA32CD0583E1

Uniqueness

Uniqueness Score: -1.00%

Function 03349085 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9647caf966e28cdf5ec456543a6b21a1e29e5659120ba05c27793e8e7e417ec4
Instruction ID: 219aac93b336b1bdc9f966c34c01fa8605789cefdb95aa5df57013c62c5f73c5
Opcode Fuzzy Hash: 9647caf966e28cdf5ec456543a6b21a1e29e5659120ba05c27793e8e7e417ec4
Instruction Fuzzy Hash: CC31AD74A142459FCB05CF58C888AAAFBB1FF8A310B15459AD845EB362C731FC81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 033490A5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b69f4f5bac442b1df902c79ab76946394a8ff6fa0d04e4c58d6b6fee17d449b
Instruction ID: d88d8f8e977dbad9a57e481e834abbfbb5af4751848ff6edb57a6c856012e150
Opcode Fuzzy Hash: 6b69f4f5bac442b1df902c79ab76946394a8ff6fa0d04e4c58d6b6fee17d449b
Instruction Fuzzy Hash: 20215974E142459FCB05CF58C8D49AAFBB1FF4A310B198596D885DB362C735EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 033490E8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400222513c4e31288686246962cb6d8d295f1f1123e62c32cb8b8648faf8f690
Instruction ID: 097c43f6d383253c481a14f3fa544cbfcfa0734a137e2f9dec21bbd1db5a4a9c
Opcode Fuzzy Hash: 400222513c4e31288686246962cb6d8d295f1f1123e62c32cb8b8648faf8f690
Instruction Fuzzy Hash: 5221E5B4A0060A9FCB04CF58C984AAAFBF1FF48310B258595D819EB365D735EC51CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0323D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321047940.000000000323D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0323D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_323d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc557902c11233b422cdc4e9de11cb63f85439d38fac98513ec4847ec723479
Instruction ID: 8bb2a6c0619ea5fcd5451767cad25d165998972bf1f5389cf06c612534a845c0
Opcode Fuzzy Hash: 8fc557902c11233b422cdc4e9de11cb63f85439d38fac98513ec4847ec723479
Instruction Fuzzy Hash: DD012DB240D3809FD7128B25CC94792BFB8EF53624F1D84DBD9848F197C2695885CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0334761B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a2c134954f69b7c930577ed997f51dfe8491ebe6faba69c2a979cd4f92248b
Instruction ID: 1914789e72383ee3d1197feed7a6ccb26c749823c422aa49f1e9b6f8c91361cd
Opcode Fuzzy Hash: 12a2c134954f69b7c930577ed997f51dfe8491ebe6faba69c2a979cd4f92248b
Instruction Fuzzy Hash: EB0144B8A402149FC704DB98D4906ADF7B5FF8D200B248159D55A9B365C736EC478B50

Uniqueness

Uniqueness Score: -1.00%

Function 0323D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321047940.000000000323D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0323D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_323d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99263d5c731d3f2755188b0e93b8f3fa7946aea2ceb58c6af567bd8419634474
Instruction ID: fb3213ca913310f84f02974b885b3f1c70b9920fad076f30690eff17a46c37f1
Opcode Fuzzy Hash: 99263d5c731d3f2755188b0e93b8f3fa7946aea2ceb58c6af567bd8419634474
Instruction Fuzzy Hash: 09012BB1418300DAE710CA29CD847A7FF9CEF42B24F0CC46AED180B146C279D8C1CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 03342C06 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2321364766.0000000003340000.00000040.00000800.00020000.00000000.sdmp, Offset: 03340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4819a93bd31991cee399ce805d525c8bd299375d6b73e1c634bfc6fd2f19e5b0
Instruction ID: d900e7a3ea2b738be2d4c83f5d128cb557b759f477fc70f0ef20736a18c79369
Opcode Fuzzy Hash: 4819a93bd31991cee399ce805d525c8bd299375d6b73e1c634bfc6fd2f19e5b0
Instruction Fuzzy Hash: E0F0D435A001099FCB15CF9DD990AEEF7B1FF88324F248159E515A72A1C736AC52CB60

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07A00560 Relevance: 14.1, Strings: 11, Instructions: 314COMMON

Download Yara Rule

Strings

#rk, xrefs: 07A0062F
tP^q, xrefs: 07A007AD
4'^q, xrefs: 07A0066F
h, xrefs: 07A00871
tP^q, xrefs: 07A007B9
xl, xrefs: 07A00825
$^q, xrefs: 07A00742
xl, xrefs: 07A00817
$^q, xrefs: 07A00774
4'^q, xrefs: 07A00663
$^q, xrefs: 07A00768

Memory Dump Source

Source File: 00000007.00000002.2370809854.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$h$tP^q$tP^q$#rk$$^q$$^q$$^q$xl$xl
API String ID: 0-1106624501
Opcode ID: 4b2024d128faab927a88180edf557ced1fbfabca3937c73c073fbc6bfb64c3f8
Instruction ID: 6861caf40fa3ae864184cf96c47a9010bfe0fac9b6c3ed311ff2fd6a4141fd32
Opcode Fuzzy Hash: 4b2024d128faab927a88180edf557ced1fbfabca3937c73c073fbc6bfb64c3f8
Instruction Fuzzy Hash: 85A177B2B042458FC7254B68A40477BBBE2AFC2311F18887BD455CB391DA36D889C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07A011B0 Relevance: 8.9, Strings: 7, Instructions: 186COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A0125A
$^q, xrefs: 07A0136E
$^q, xrefs: 07A01337
xl, xrefs: 07A013B3
xl, xrefs: 07A013A5
4'^q, xrefs: 07A01266
$^q, xrefs: 07A01362

Memory Dump Source

Source File: 00000007.00000002.2370809854.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q$xl$xl
API String ID: 0-2316656652
Opcode ID: 05c63cb9826b8783a7281e341e7ad6d376cd74ebf98919754d31b184d22fd435
Instruction ID: e0c9ee03d0b00e779b69858b2b1848fbc78aa289f7469d431358fd404e877f94
Opcode Fuzzy Hash: 05c63cb9826b8783a7281e341e7ad6d376cd74ebf98919754d31b184d22fd435
Instruction Fuzzy Hash: 245109B170424ECFCB294B79E4047EEBBA6ABC6310F14887AD415CB6D1DA35C885C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 07A01460 Relevance: 8.9, Strings: 7, Instructions: 118COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A014A4
tP^q, xrefs: 07A014E9
xl, xrefs: 07A01547
$^q, xrefs: 07A01498
tP^q, xrefs: 07A014DD
xl, xrefs: 07A01555
$^q, xrefs: 07A01472

Memory Dump Source

Source File: 00000007.00000002.2370809854.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$$^q$$^q$$^q$xl$xl
API String ID: 0-2840224845
Opcode ID: 2d2ef2b996df23d3c91edcc0566ea14bc67994e6f25bde1f29a9d0ace957408a
Instruction ID: 95a47d3c2af8ac99e25ee40d825173aaf73ff28b7478ac45dbdc83b70773010d
Opcode Fuzzy Hash: 2d2ef2b996df23d3c91edcc0566ea14bc67994e6f25bde1f29a9d0ace957408a
Instruction Fuzzy Hash: 9B31F5B27082598FD7148B69E404AAABBF1ABC6720F14886AE555CF3A1DA32DC44C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 07A032C0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A0331C
$^q, xrefs: 07A032EE
$^q, xrefs: 07A03328
$^q, xrefs: 07A032D2

Memory Dump Source

Source File: 00000007.00000002.2370809854.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: c601b965965cae14f6e016d778c5681ea59ddc9f1dc016fc3b9f53fa52c0ec73
Instruction ID: b3be63ba14451db979a7d9b3f787d8dd874ab4e2629969da529a78004e0688e8
Opcode Fuzzy Hash: c601b965965cae14f6e016d778c5681ea59ddc9f1dc016fc3b9f53fa52c0ec73
Instruction Fuzzy Hash: 8E2137B171030AABDF38567A6885B2AB6DA5BC5711F248C3EA425CF3D5CD75C841C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 07A0030A Relevance: 5.0, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A00373
$^q, xrefs: 07A0035E
$^q, xrefs: 07A00352
4'^q, xrefs: 07A0037F

Memory Dump Source

Source File: 00000007.00000002.2370809854.0000000007A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a00000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 475c67d3c739dc8add4191ba1498b5627bc486c4e5938d0b2bff3cca84c988db
Instruction ID: 4eec0552e5ea3b475ef90274446331c836baf4ad2e8139fae868f3e02d8bb263
Opcode Fuzzy Hash: 475c67d3c739dc8add4191ba1498b5627bc486c4e5938d0b2bff3cca84c988db
Instruction Fuzzy Hash: 0301A2617093964FC32F176829242666FB25FC3A51B1948EBC091DF3ABCD148D4A83E7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: payment_invoice.exePID: 6692, Parent PID: 2580COMMON

Executed Functions

Function 0605D4B8 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 0605D5BD

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: dd09d392456d90ffee8f381fbd653f0ba4f4e82ccc040a7a190f96ccdc76f166
Instruction ID: 12ba29c005765015258afda0648197ef01ad5f69126c6d9cdd981b53ffd705b3
Opcode Fuzzy Hash: dd09d392456d90ffee8f381fbd653f0ba4f4e82ccc040a7a190f96ccdc76f166
Instruction Fuzzy Hash: 35D19E74E00218CFDB54DFA9D994B9DBBB2FF88304F2181A9D409AB365DB30A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 027B3F2F Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81932c018517fb27fb0ca9980c9e47074635e7914c243639c52e38c5a5a8ea76
Instruction ID: 8a146a4e78a009c0069b18f439730e72b942017e907c374fdf8cef1ef1de3aa3
Opcode Fuzzy Hash: 81932c018517fb27fb0ca9980c9e47074635e7914c243639c52e38c5a5a8ea76
Instruction Fuzzy Hash: B4B1F570E05218CFDB15DFA8D898BEDBBB1FF4A304F1091AAE409A7255EB349985CF44

Uniqueness

Uniqueness Score: -1.00%

Function 027B2480 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f78b9d28ed555a7af41e1e9e0891c2e11e39b8aa65f465844bb46750d1aa8a
Instruction ID: dd0a7b6887cc72684a268e1d524d53a759fc41fd01ed5779b59ec297df2d569c
Opcode Fuzzy Hash: b2f78b9d28ed555a7af41e1e9e0891c2e11e39b8aa65f465844bb46750d1aa8a
Instruction Fuzzy Hash: CEC148B4D05629CFDBA5CF29CC54BD9BBB5AF49300F1081EAE90CA7251EB319A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B17E1 Relevance: 2.5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

Strings

#, xrefs: 027B1811
4, xrefs: 027B1FE0

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: #$4
API String ID: 0-353776824
Opcode ID: 14a16a3c89df9a61e300117848b8b9f05c403ce3237df6f3bb35ebf8d3585b12
Instruction ID: fede28b031bec0731924fe38585c0d946b919b6623ed2fdb77fc28c7e56e44dd
Opcode Fuzzy Hash: 14a16a3c89df9a61e300117848b8b9f05c403ce3237df6f3bb35ebf8d3585b12
Instruction Fuzzy Hash: EF118BB4902268CFDB61DF54DA98BEDBBB1FB05300F50449AD209BB280DB769A84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 027B1988 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

@, xrefs: 027B1998
1, xrefs: 027B167E

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 1$@
API String ID: 0-1574762115
Opcode ID: 3cc67760c1e797372b594c3d310055720b09694906e67859abba739f1e30ef65
Instruction ID: e25fa48947fd07a519194b1f8995b051c078864ef6f71d302c9d163db4631ec6
Opcode Fuzzy Hash: 3cc67760c1e797372b594c3d310055720b09694906e67859abba739f1e30ef65
Instruction Fuzzy Hash: 8701CF78909298CFCB11CF14C998BE8BBB0FB06314F4494E6D90EB7241D7749A84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 027B1704 Relevance: 2.5, Strings: 2, Instructions: 23COMMON

Download Yara Rule

Strings

D, xrefs: 027B1735
, xrefs: 027B175E

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: $D
API String ID: 0-1196817373
Opcode ID: 00e0fa0ad6a6b461e8999fe9a49776e086a624a2e38eb0418d75cbe0252531f8
Instruction ID: 4c5308827f139e89b1d9efc101f6ff70e122057403dab1e0c8d19a663fe6b7bd
Opcode Fuzzy Hash: 00e0fa0ad6a6b461e8999fe9a49776e086a624a2e38eb0418d75cbe0252531f8
Instruction Fuzzy Hash: F4F09D7490526DCFDB21CF14CA48BE8BBB1FB19304F4085E6D109A3291E3749AC4CF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B168D Relevance: 2.5, Strings: 2, Instructions: 19COMMON

Download Yara Rule

Strings

F, xrefs: 027B1698
%, xrefs: 027B1B16

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: %$F
API String ID: 0-2945472538
Opcode ID: 28f4bd74c6e76700368b69311f188ba2dc7c660e06f5ca5b60665fd856ea3e26
Instruction ID: 32e9b8bb500433d2f49052be79a81194cbfcd69c9bc4b9b3fd171c3c0c3c491c
Opcode Fuzzy Hash: 28f4bd74c6e76700368b69311f188ba2dc7c660e06f5ca5b60665fd856ea3e26
Instruction Fuzzy Hash: 31E0C275806268CFDB60CF60CA48BE8BBB1EF0A305F109199C00D632A1D7385A89CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0605E978 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,bq, xrefs: 0605ECF3

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: b3fd24f6cf0fd006d2182f039f1a0493520dec8aaab7ba1109b32cd89eaceab0
Instruction ID: c4d119a35a51e192dcc25420cab64b77ff5dde5788a42fd3429df0333336e23d
Opcode Fuzzy Hash: b3fd24f6cf0fd006d2182f039f1a0493520dec8aaab7ba1109b32cd89eaceab0
Instruction Fuzzy Hash: 7A521C75A002288FDB64CF68C985BEDBBF2BF88300F1541DAE549A7351DA309E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 06045BC3 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

%, xrefs: 0604DB01

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 21d8de076f68cb36a322efdfd8342ae4b064da4e272f8c938f918478f2512e97
Instruction ID: 855343d250c5eded2809e6a64b2f92d643ed05723f27c53c109cea301c6f109b
Opcode Fuzzy Hash: 21d8de076f68cb36a322efdfd8342ae4b064da4e272f8c938f918478f2512e97
Instruction Fuzzy Hash: F711F9B0945229CFDBB0EF64C888B9DB7F1AB45304F9051E6E219A3690DB345EC8CF05

Uniqueness

Uniqueness Score: -1.00%

Function 027B13D7 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4, xrefs: 027B1FE0

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 466a6f1fcc8cd6f3ce4a795071d7643f1fd7bed576faed1a4b6e2c3d01ba50d0
Instruction ID: 8a68f65adc695bc2751f16e7a44868e4d20d949f3dc2c9046a90c77efac547cf
Opcode Fuzzy Hash: 466a6f1fcc8cd6f3ce4a795071d7643f1fd7bed576faed1a4b6e2c3d01ba50d0
Instruction Fuzzy Hash: 2B11AE74A06258CFDB26DF18DA58BD9BBB2FB49300F5084AAD109B7295D3369A80CF00

Uniqueness

Uniqueness Score: -1.00%

Function 027B1E77 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

H, xrefs: 027B1E85

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 2c00225a646a2bbc6bd7d82a626f409e6568ec2d17a54cba9f1f2de913d164ca
Instruction ID: fe340791bb6b9d122dcd8b906fc478bbebff235d333092683c78b7c3f351a71f
Opcode Fuzzy Hash: 2c00225a646a2bbc6bd7d82a626f409e6568ec2d17a54cba9f1f2de913d164ca
Instruction Fuzzy Hash: C701DD749052A8CFDB22CF54C968BECBBB1FB09300F4084E6D609B3290C3754A98CF00

Uniqueness

Uniqueness Score: -1.00%

Function 027B1354 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

,, xrefs: 027B1362

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 32254a1d918dc0659de296ec63a3716e2bd56c3f7ead5f2881c922345d47b34a
Instruction ID: 261712d257b88fad11c76b0e0dc5f16a8ebfb7549befb1a2f7053c14c31f8aaa
Opcode Fuzzy Hash: 32254a1d918dc0659de296ec63a3716e2bd56c3f7ead5f2881c922345d47b34a
Instruction Fuzzy Hash: C301DD349052A8CFEB22CFA4C958BEDBBB1FB09304F4084E6D609B3290C3754A94CF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B14F8 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

4, xrefs: 027B1FE0

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 3c267bffadf7c6cf51fbc152fb1ddcb26753a6bcc503e9785b416030c82d6c0b
Instruction ID: 37b25d0c9cac5647dda6f134c2dc960de1f9709d6d4c17a7c3bb93427f70be00
Opcode Fuzzy Hash: 3c267bffadf7c6cf51fbc152fb1ddcb26753a6bcc503e9785b416030c82d6c0b
Instruction Fuzzy Hash: 27F09D74A06298DFDB12DF54DE58BDABBB1FB09300F5045A5E209BB280D3765E80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B1B9B Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

1, xrefs: 027B167E

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 0a1f77496c6ca2c9fefc98dc7bac339856c422e6a4e33dda24c492edee56c5df
Instruction ID: c67fa98dc56e3f42cce066594d421a15463032170f03ffe572ee4510ee59eee9
Opcode Fuzzy Hash: 0a1f77496c6ca2c9fefc98dc7bac339856c422e6a4e33dda24c492edee56c5df
Instruction Fuzzy Hash: B8F0AA74909268CFCB25DF24D968BECBBB1EB49304F40549A940AB7291DB309A88CF05

Uniqueness

Uniqueness Score: -1.00%

Function 06046B5F Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

K, xrefs: 06046B85

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 2d96a48b54b11e83ffb2d676bcf3f59ccc3749c42b13c00372cab6d32fdaa2ed
Instruction ID: 305d4480b7a264efb2f226c4c64e2e2cd04c28db443e3d85798b4651dc5dfa3d
Opcode Fuzzy Hash: 2d96a48b54b11e83ffb2d676bcf3f59ccc3749c42b13c00372cab6d32fdaa2ed
Instruction Fuzzy Hash: 39F0FEB4D44219CFDB65AF54D884BE977F1EB49305F5080F59209A7640D6784EC88F41

Uniqueness

Uniqueness Score: -1.00%

Function 027B1635 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

1, xrefs: 027B167E

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 7ef1a11e02649f167cb4bc708aefdf9e358f884141204736657cba329ffb82ea
Instruction ID: a37f24a067b81a9c2a32542ad00a17b9c4b0aa5b580d7bf882127a8c7f2636a1
Opcode Fuzzy Hash: 7ef1a11e02649f167cb4bc708aefdf9e358f884141204736657cba329ffb82ea
Instruction Fuzzy Hash: 86E0AE749052188FCB65DF24D994AECBBF1FB88300F40559A940AA7261DA309E84CF04

Uniqueness

Uniqueness Score: -1.00%

Function 027B1238 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

A, xrefs: 027B126F

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 1fdaa7d8ec1da36978415ef68eb734b46d969e93d9e9f872270b7d875ba7d509
Instruction ID: f0f8c5f7993b4b99e2885c2fb214c85b2a82e47220090325ba228a1b158685a3
Opcode Fuzzy Hash: 1fdaa7d8ec1da36978415ef68eb734b46d969e93d9e9f872270b7d875ba7d509
Instruction Fuzzy Hash: 1AE092759482599FDB20CF50D909BEDBAB1FB04305F004195E609B6691D3745A85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 027B14A2 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

1, xrefs: 027B167E

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 8f2cd0fbd8068efbf38b1fc11236d2925f88579562ee26513f0186b39eb6cdb9
Instruction ID: aaf571ecf56fe6076ec5e1f13df590eb60ca04565417ea5f5f55a35593a58bcb
Opcode Fuzzy Hash: 8f2cd0fbd8068efbf38b1fc11236d2925f88579562ee26513f0186b39eb6cdb9
Instruction Fuzzy Hash: 2ED06778905218CFCB51CF64D598ADCBBB5EF49310F449096D409F3350EB309A85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 027B2471 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cf857931c409cb0ab0d8a3f8844532bdcd0363d14f3e71ad46b579178cfe46
Instruction ID: 3f42afca783e0936f2694ea01407e9d7f38de1404bd7f9446d98e5807e470837
Opcode Fuzzy Hash: d9cf857931c409cb0ab0d8a3f8844532bdcd0363d14f3e71ad46b579178cfe46
Instruction Fuzzy Hash: 6DB14874D05628CFDBA5CF69CC54BD9BBB5AF49300F1082EAE90CA7251EB349A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B2521 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4a537a9cd36591d072eae03ae3b6bb13c7cbe3148897961409569d477387af
Instruction ID: 6fff343fa9347fd4a1560a61bba972ade8cd9f30dc26b1cc17edb838731f35bc
Opcode Fuzzy Hash: 6b4a537a9cd36591d072eae03ae3b6bb13c7cbe3148897961409569d477387af
Instruction Fuzzy Hash: 9FB148B4D016288FDB65CF69CC54BD9BBB1BF49300F1082EAE90DA7251EB309A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B2742 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb31a9f2ecf0618ed90d9e9324717e95d4cc5f7b3cac526b4f217081f7b523d
Instruction ID: 4db41cfc3017d67601a783cd0d1a5ee5fba211781b20eb105e13492c706684be
Opcode Fuzzy Hash: afb31a9f2ecf0618ed90d9e9324717e95d4cc5f7b3cac526b4f217081f7b523d
Instruction Fuzzy Hash: 8EB14774D066298FDBA5CF29CC54BD9BBF5AF49300F1081EAE94CA7251EB309A85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B2A45 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30cfe4e712d837d77402303f99eae27a3661bd88c4716e6d4a6b5eb2cd36a63
Instruction ID: 3384c5eb0b46e49017986e177a4c7849ffecba84aef67fcfc37082a642d97990
Opcode Fuzzy Hash: b30cfe4e712d837d77402303f99eae27a3661bd88c4716e6d4a6b5eb2cd36a63
Instruction Fuzzy Hash: 81B147B4905629CFDB65CF69CC54BD9BBB5BF49300F1082EAE90CA7251EB309A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B27D0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486686a1e241cef6261729c732617c1af1defe1c91f17c064a6db0e4df22f5da
Instruction ID: 50679664d5bfa8b19f4f11d9b06920bc29a6a80f24254d6e533b9a1872512e3b
Opcode Fuzzy Hash: 486686a1e241cef6261729c732617c1af1defe1c91f17c064a6db0e4df22f5da
Instruction Fuzzy Hash: B3B13774901629CFDB65CF69CC54BD9BBB1BF49300F1082EAE94CA7251EB30AA85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B29D0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4ede26e270a9667d5cceb4e1dfa480e26cb41abd501d5ea2a1c40aa5899daa
Instruction ID: 1333a94178906a0013dbb0fcec544b9491e7ac40f7ba23d14d9f5b5d324ee618
Opcode Fuzzy Hash: 4a4ede26e270a9667d5cceb4e1dfa480e26cb41abd501d5ea2a1c40aa5899daa
Instruction Fuzzy Hash: 6EB13674901629CFDBA5CF69CC54BD9BBB5BF49300F1082EAE90CA7251EB319A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B2827 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07beb278e385a23bba715177ae27886fb127a88999d2be5e9018d95a6790ec5
Instruction ID: b03a0cab36be46b4600f690815f2c03719c8456f6ca804a9a5503e4efe07075c
Opcode Fuzzy Hash: e07beb278e385a23bba715177ae27886fb127a88999d2be5e9018d95a6790ec5
Instruction Fuzzy Hash: 25B14674905628CFDBA5CF69CC54BD9BBB1BF49300F1082EAE94CA7251EB309A85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B28A1 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d348b19ce3d3fdae73eaf61f47027c4d18d9d8d63830a070bc7e6aa2a8d633
Instruction ID: 928b29ebaca37da47aeaf255aeb4ede8cf1eb5e734598f5e74474fce953ba332
Opcode Fuzzy Hash: 19d348b19ce3d3fdae73eaf61f47027c4d18d9d8d63830a070bc7e6aa2a8d633
Instruction Fuzzy Hash: 01B14774905629CFDBA5CF69CC54BD9BBB1BF49300F1082EAE90CA7251EB309A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B26A9 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6fae6e933a2da2adfe5fe2f3701ba2849303df83687774e294a17f201ff743
Instruction ID: 47082b600ce8ef4fb52b094140fcad2ee4ea6f0816050ed2ea428a295531647b
Opcode Fuzzy Hash: 2e6fae6e933a2da2adfe5fe2f3701ba2849303df83687774e294a17f201ff743
Instruction Fuzzy Hash: 9FB137749056298FDBA5CF69CC54BD9BBB1BB49300F1082EAE90CA7255EB309A85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B2643 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8194b7b6cfeb0f6833e07ea5460657b33ec9995daa2d0610d9c08882557b7b29
Instruction ID: 39b5c56f1b6f05b640e4da33d6da33adefa0009b6cfa2cafe31bb0a0f5cbda40
Opcode Fuzzy Hash: 8194b7b6cfeb0f6833e07ea5460657b33ec9995daa2d0610d9c08882557b7b29
Instruction Fuzzy Hash: CAA14674905629CFDBA5CF69CC54BD9BBB1BB49300F1082EAE90CA7251EB309A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C0D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2794593660.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0d000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71a14e395c47ee5fd24e24df3a0fe3a06b9b27fb9298ed4aa10e3d02bd533ac
Instruction ID: 370cdd89fc01f426234ba71a4e65e30d287a7f8e6478c1126324eb0b5f44922c
Opcode Fuzzy Hash: e71a14e395c47ee5fd24e24df3a0fe3a06b9b27fb9298ed4aa10e3d02bd533ac
Instruction Fuzzy Hash: 74213471104240DFDB10DF58DAC4B27BFA5FB84328F20C569E90E0B286C336D84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C0D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2794593660.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0d000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c7822ad48e6627aeb66fcef325633bd634ea91e4f9cc16e131f2a28b208e25
Instruction ID: db98f7f82e87945792ff59b04aadc3be1299bfde8ffa8a992ad180d9237a2437
Opcode Fuzzy Hash: f6c7822ad48e6627aeb66fcef325633bd634ea91e4f9cc16e131f2a28b208e25
Instruction Fuzzy Hash: C321B0710093C08FCB02CF24D994716BF71EB86314F2981EAD8498B693C33A990ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0605D940 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f693c07266e46ac5e8f4994378f35c244d0ae9779f132d88a8864a6b6b836a
Instruction ID: 26eea4eefa6200f044dee71e9bd9e08c74b108abe51528bde5252f0e54d0f4a9
Opcode Fuzzy Hash: 35f693c07266e46ac5e8f4994378f35c244d0ae9779f132d88a8864a6b6b836a
Instruction Fuzzy Hash: F811A2B0E002099FCB48DFA9C9457BFBBF5FF88300F20846A9918A7354DA359A45DB95

Uniqueness

Uniqueness Score: -1.00%

Function 027B2400 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c0672af25949d52f3d51e97ddfc8f70198b91af7b8dfd0b274731df77de2ed
Instruction ID: 5e28f40ac4cf80f183a2e9b1439f434dff7b4503d231726ca821d3452b5b085f
Opcode Fuzzy Hash: 44c0672af25949d52f3d51e97ddfc8f70198b91af7b8dfd0b274731df77de2ed
Instruction Fuzzy Hash: 4A011D31C0061ADBCF019F99D841AEEBB75FF89310F04C619EA5877251D731A662DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0605FE00 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aba1eaa1c1047fb63fa5763c87fef5a607ce16641fde439866447defbd0c53f
Instruction ID: 94fd93eabc525b738aaa7cc317ae45007e25f84a4965b130daf3d21006aec3e9
Opcode Fuzzy Hash: 7aba1eaa1c1047fb63fa5763c87fef5a607ce16641fde439866447defbd0c53f
Instruction Fuzzy Hash: 53F036312403055FC724DF19D981D9BFBAAEFC4314B008A3AB51A87665DAB1FD4D8690

Uniqueness

Uniqueness Score: -1.00%

Function 027B127E Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f01edcd3f39426729f0d1a02640d20d97d1cccbf137125b1c1fb71583b868d
Instruction ID: 9804a3c4bfde65216470f003dfc46912f8ce76809284368c331868bda3ac6dce
Opcode Fuzzy Hash: e2f01edcd3f39426729f0d1a02640d20d97d1cccbf137125b1c1fb71583b868d
Instruction Fuzzy Hash: BC0190749051A8CFDB65DF64D958BECBBB2FB09300F4088EAD10AB7290DB355A98CF14

Uniqueness

Uniqueness Score: -1.00%

Function 027B2410 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a17bf29681038c809d9282ac60e9ea23f94285f723a6a148c074ca15b6824d1b
Instruction ID: 8fb0ecb3ae22b0e8f6038c6ad61b4c44937396e448cd82d9224d5ad03ddc53fc
Opcode Fuzzy Hash: a17bf29681038c809d9282ac60e9ea23f94285f723a6a148c074ca15b6824d1b
Instruction Fuzzy Hash: 26F0F931D0060AEBCF01DF99D8009EEBB75FF89324F10C519EA5837211D731A6A6DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0605FF38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a62c5503b995399fe9050caab85890b9226799e50a1df3b1d0c7abb70d31e8
Instruction ID: be50b7a2286915a6b7d43d2458d3036bfb4c616f58936afe6507e9031084384f
Opcode Fuzzy Hash: 79a62c5503b995399fe9050caab85890b9226799e50a1df3b1d0c7abb70d31e8
Instruction Fuzzy Hash: 83F05E393106009FC308DF59D858D3A77AAFFC9721B10406AFA068B360CA71EC02DB90

Uniqueness

Uniqueness Score: -1.00%

Function 027B2DD1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77c32e2cd7509c873efdd28d20121168f49b82dee0bd1f6d32d50c3d31131de
Instruction ID: c9d66aed11e2d0395602486fa118ad9744d0fb06587cd14f03eceae684e20d49
Opcode Fuzzy Hash: b77c32e2cd7509c873efdd28d20121168f49b82dee0bd1f6d32d50c3d31131de
Instruction Fuzzy Hash: 5EF06D7980A248AFCB02CFA4D845AECBFB5EF45301F14819AEC8467352C7318A12EB41

Uniqueness

Uniqueness Score: -1.00%

Function 027B1A67 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03faf5f0769cf966849840c7ecab4a23ebfd995bb47b6445489efffefe5f034f
Instruction ID: 2620f6bc7da56a883a4754e5511aff3c66f5b2368dc65901b3cedfbee5bce97a
Opcode Fuzzy Hash: 03faf5f0769cf966849840c7ecab4a23ebfd995bb47b6445489efffefe5f034f
Instruction Fuzzy Hash: 2B01EF78A45268CFDB21CF58C988BE8BBB1FB09300F1484DAD609A7281D3369E85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 027B36A8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f789b5e2540bacdcb30be090d5268809209976043a20003ed41667ab932c2b
Instruction ID: 45fa2e6480258f9ebba6ca9b4c57486a529bbda496fdf47302564d72ffb282e8
Opcode Fuzzy Hash: 97f789b5e2540bacdcb30be090d5268809209976043a20003ed41667ab932c2b
Instruction Fuzzy Hash: 9EF0DA35904209EFCB41CF98D841BDDBBB5EB48314F14C5AAEC05A6350D7329A61EB41

Uniqueness

Uniqueness Score: -1.00%

Function 027B0F00 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744b67b71db51fef1f8cc1f7a4c111a87a4ef5108e8cd47d9ed1519e21fe4192
Instruction ID: b50d7c88380a9aa739a8f5379e938169ae628214951c2451646304276c53870e
Opcode Fuzzy Hash: 744b67b71db51fef1f8cc1f7a4c111a87a4ef5108e8cd47d9ed1519e21fe4192
Instruction Fuzzy Hash: 94F01C35904109EFCB01DF94D941BEDBB75EF49314F249499F80467251C7329A61EB51

Uniqueness

Uniqueness Score: -1.00%

Function 027B3658 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17375b80f4f70f13a14148f60726162fbde5b6cfd0654abd8529caa90b5ea395
Instruction ID: e5692feaf54797f0fb7825d6a4cf95884ea5f2a9940fe3124d551caf4f10cef8
Opcode Fuzzy Hash: 17375b80f4f70f13a14148f60726162fbde5b6cfd0654abd8529caa90b5ea395
Instruction Fuzzy Hash: 7FF03074D04209EFC740DFA4D8467ECBBB4EB48314F14C1AAD80457341D6359A42EB45

Uniqueness

Uniqueness Score: -1.00%

Function 027B3700 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de77140503f0ca228e933aea31e89737a738e17b43d1e6c32177d54814f08335
Instruction ID: c23bbc005b2de5305ac41eeee2bebeccde683543e9b73381e84e7d5d663dca3b
Opcode Fuzzy Hash: de77140503f0ca228e933aea31e89737a738e17b43d1e6c32177d54814f08335
Instruction Fuzzy Hash: C8F05E75904248EFCB52CFE4D841AAD7FB1FF4A311F1480DAEC5553251C6328A51EB51

Uniqueness

Uniqueness Score: -1.00%

Function 027B37E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2686cbd93592c558cf95381aa0a0859751333bd39957969bb699948f8d5926
Instruction ID: 0091ad92c7b578e61e12359de2f7120a08821325cfbbd82c85431898256b669f
Opcode Fuzzy Hash: ff2686cbd93592c558cf95381aa0a0859751333bd39957969bb699948f8d5926
Instruction Fuzzy Hash: DCF03974D04208EFCB05CFA8D8427ECBBB4EB48301F14C1BAEC44A7351E6359A52EB92

Uniqueness

Uniqueness Score: -1.00%

Function 027B3839 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547b72d4a4296e0f21641a391fb3e67ae0cad87c01bd956692613cc91851f3f9
Instruction ID: a1face11e7978201a7d4ef450a61c08a3c0f91f5fefdc6b2acaff04f58f87689
Opcode Fuzzy Hash: 547b72d4a4296e0f21641a391fb3e67ae0cad87c01bd956692613cc91851f3f9
Instruction Fuzzy Hash: CFE0ED34D05208EFCB44DF98D5427ACB7B4EB48304F14D5E9D808A7740D7319A46DB82

Uniqueness

Uniqueness Score: -1.00%

Function 027B0100 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795ba97888616e73af57dae5563c532bb6cdb37f6446660335aab40bf18658fe
Instruction ID: 52a5c4f196eb482af37b4aa623fa4ee8fd82796e3f0ee72eda8d26b94eedda71
Opcode Fuzzy Hash: 795ba97888616e73af57dae5563c532bb6cdb37f6446660335aab40bf18658fe
Instruction Fuzzy Hash: 8FF05E7440924CEFCB06DFA4DC40AADBFB5EF49300F14909AE84416262C6318A62EB61

Uniqueness

Uniqueness Score: -1.00%

Function 0605DD08 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c077fae9c43339468cf3513356d0eea0de4960c641b3158c258a95474d7a544
Instruction ID: 29c28730bbc3d8c614e97f0fbb1de872d6c602d302cf91f532d3fb4060353534
Opcode Fuzzy Hash: 9c077fae9c43339468cf3513356d0eea0de4960c641b3158c258a95474d7a544
Instruction Fuzzy Hash: ACF0F874D04208EFCB80DFA8D840AAEBFF8EB48310F14C09AAC58D3241D6359A51EF50

Uniqueness

Uniqueness Score: -1.00%

Function 027B2E97 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745d843a3598057d0ac6e9e4eb448b92fe57f38aa217caaa0ce0319b1eb6518b
Instruction ID: f14cf0414a6a860c19554876272d535fab4baf2e748cca5b7e5e0a065c1ed8b3
Opcode Fuzzy Hash: 745d843a3598057d0ac6e9e4eb448b92fe57f38aa217caaa0ce0319b1eb6518b
Instruction Fuzzy Hash: 53F01579909108EFCB42CF89D844BECBBB1EF48311F14C59AEC1456251C7328A51EF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B3EC0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6db520cf0416f17917eb9556605a68c206dee0225f00b7a9934d189ec6b24e
Instruction ID: 766abc48137a280f238c55ee3f088f953221b8c29a1a31b6d9d7d62d001228ce
Opcode Fuzzy Hash: 5d6db520cf0416f17917eb9556605a68c206dee0225f00b7a9934d189ec6b24e
Instruction Fuzzy Hash: 03E04F74904108EFC744DF98D9857ADBBB8EF45314F2495A9D80867341DB32AE61DB81

Uniqueness

Uniqueness Score: -1.00%

Function 027B36B8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92de8a15aa7b2b4d41078a994d9383280f1d69a626d6f0b8e4c4a1669043bae8
Instruction ID: 96bf4a962d72910759bd17a5c59ffc9d9741db313f0bf3df7ee6d903ef7ed550
Opcode Fuzzy Hash: 92de8a15aa7b2b4d41078a994d9383280f1d69a626d6f0b8e4c4a1669043bae8
Instruction Fuzzy Hash: B2F0A535A04208EFCB45DF98D940AADBBB5EF48314F10C499ED1967351D7329A61EF41

Uniqueness

Uniqueness Score: -1.00%

Function 027B3710 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d541eedfc2490d9799b021dd1ac4c4115b2c9d6df6a2cdad77ca35bbe06066
Instruction ID: ddc1623806b0c8dfab2bac41c8ecb709e6db3a673c2d3c59c2cc27e9f26c25ee
Opcode Fuzzy Hash: b5d541eedfc2490d9799b021dd1ac4c4115b2c9d6df6a2cdad77ca35bbe06066
Instruction Fuzzy Hash: D2F01574904208EFCB41CF98D880AADBBB5EF49310F10C099EC5462351C7329A61EF41

Uniqueness

Uniqueness Score: -1.00%

Function 027B2E20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb041ff95b8133a57b481bf6a16fc43c18bf5272fdc48ca5dd662a5e4883e5e
Instruction ID: 38da9a269888363d5b7db9b6286551aaaada744696d408e72e96b252eb9d37a9
Opcode Fuzzy Hash: 6fb041ff95b8133a57b481bf6a16fc43c18bf5272fdc48ca5dd662a5e4883e5e
Instruction Fuzzy Hash: DCF03938909208EFCB02CF98D840AEDBBB5EF48310F10C099EC5452351C7329A51EF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B0110 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ab6a0dec5cee0d2c001909034014ccaf42c8f6f874ae10d67f464b707604ef
Instruction ID: da5e4b9957aba7c8e6a0fa580b268f1784f5b720c89b5a90f85dbe3094e202d5
Opcode Fuzzy Hash: d6ab6a0dec5cee0d2c001909034014ccaf42c8f6f874ae10d67f464b707604ef
Instruction Fuzzy Hash: 03E0E53590510CEBCB05DFA4E940AEEBBB5EF49310F109499EC0427261C7329A61EB91

Uniqueness

Uniqueness Score: -1.00%

Function 027B0F10 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ab6a0dec5cee0d2c001909034014ccaf42c8f6f874ae10d67f464b707604ef
Instruction ID: 33913b835e3dde44b7541d7dd939c625506c09ac93a83ec94d452741f7e7bf16
Opcode Fuzzy Hash: d6ab6a0dec5cee0d2c001909034014ccaf42c8f6f874ae10d67f464b707604ef
Instruction Fuzzy Hash: 28E0E535A08108EFCB05DFA4E944AEEBBB5EF49310F109499FC0427261C7329A61EB91

Uniqueness

Uniqueness Score: -1.00%

Function 0605BE08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01132e5e3bf1fc1b2f0bd71c7e6eb8ed351b3f8577c913a42d7fdcb085b133b
Instruction ID: 530b73034b88da7f230b1072395537d5f2326510954ee5bf9dea245fdd7b6e5e
Opcode Fuzzy Hash: a01132e5e3bf1fc1b2f0bd71c7e6eb8ed351b3f8577c913a42d7fdcb085b133b
Instruction Fuzzy Hash: D4E0ED74E44208EFCB84DFA8D4416ADFBF4EB48310F14C0A99C0893350E731AA51DF81

Uniqueness

Uniqueness Score: -1.00%

Function 06059090 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01132e5e3bf1fc1b2f0bd71c7e6eb8ed351b3f8577c913a42d7fdcb085b133b
Instruction ID: 35917019e80ebd78a37938ad7af18629061255fa59edb3c648caeb358c9bb8b6
Opcode Fuzzy Hash: a01132e5e3bf1fc1b2f0bd71c7e6eb8ed351b3f8577c913a42d7fdcb085b133b
Instruction Fuzzy Hash: 1EE0ED74E44208EFCB94DFA8D4406ADFBF5EB48310F10D4AADC1893351D6319A51DF81

Uniqueness

Uniqueness Score: -1.00%

Function 0605D460 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421f3d96212ef06ea2bf88ae9a877fbe61e6aca83324f28fee4c060c9b595ed3
Instruction ID: 1d15711d97b414f2aec1af0b7ad5964a75aed388b4a606cb9a773d681918e8e8
Opcode Fuzzy Hash: 421f3d96212ef06ea2bf88ae9a877fbe61e6aca83324f28fee4c060c9b595ed3
Instruction Fuzzy Hash: 65E04F7094920CDFCB84EFF8D5453AEBFF4EB09301F5141B9A80893380DA301A80EB56

Uniqueness

Uniqueness Score: -1.00%

Function 027B3668 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d6309890c048ef27aad04759b21341dfb369615341211202c9bd5d619613ef
Instruction ID: 8f4160e0949ad63554941195ad2748f1cad153d001e4393ff80f1c613d707ab1
Opcode Fuzzy Hash: a9d6309890c048ef27aad04759b21341dfb369615341211202c9bd5d619613ef
Instruction Fuzzy Hash: FBE0E574904208EFCB45DFA8D5446ACBBB4EB88314F10C1AAA84463351D6319A91EF85

Uniqueness

Uniqueness Score: -1.00%

Function 027B4830 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0268fe95a9beca764888fe764e63a8e8425884028f364efdbf2e1360723efb
Instruction ID: 3cb990ce5942fe9ab634e7db3505886b84e7f31e9017f5b7bf2f031c897e7c45
Opcode Fuzzy Hash: 5c0268fe95a9beca764888fe764e63a8e8425884028f364efdbf2e1360723efb
Instruction Fuzzy Hash: 8DE0C2F044F2C8DFCB02C7A89C227A93B7CDB02204F1920DA9548532A2DA311E00D715

Uniqueness

Uniqueness Score: -1.00%

Function 027B37F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d6309890c048ef27aad04759b21341dfb369615341211202c9bd5d619613ef
Instruction ID: 740de81abf216f6f1407660898ec29842af64c6b0c6148f3ebb74c2c02a5a244
Opcode Fuzzy Hash: a9d6309890c048ef27aad04759b21341dfb369615341211202c9bd5d619613ef
Instruction Fuzzy Hash: CFE0E574904208EFCB45DF98D4416ACBBB4EB48314F10C0AAA84467351D6319A91EB91

Uniqueness

Uniqueness Score: -1.00%

Function 0605E930 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8048ae1326c15ef243ed1464fbb2aaaf5b6218f1433d7e16baa19e7733813408
Instruction ID: 330263732f87e673f11ec54ed2574375ff49d74976dd4e121dea3e29fa427108
Opcode Fuzzy Hash: 8048ae1326c15ef243ed1464fbb2aaaf5b6218f1433d7e16baa19e7733813408
Instruction Fuzzy Hash: 56E086B4948108EFCB84DF98D841ABEBFB8EB45310F14D099EC8857381C6319B42EB91

Uniqueness

Uniqueness Score: -1.00%

Function 027B3848 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2eb8071c9f6fc4bb28a27f8674ed27a7af6dc07fc28b138db5620fb33c7833
Instruction ID: fb1f59a45e3d8b47bc7c25aa3634a07a4ce3fce6e3d34ee344106544414b4208
Opcode Fuzzy Hash: 5b2eb8071c9f6fc4bb28a27f8674ed27a7af6dc07fc28b138db5620fb33c7833
Instruction Fuzzy Hash: 38E09A74D05108EFCB44DF99D5416ACBBB4EB48314F1081E99808A7351DB315A41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 027B1D9C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3751498352f040cba19f009d69716c5bf58430d39e6dfa8ee8256390bb52f14e
Instruction ID: 06184c13629eee2c15c924fadfb5003a54d535f389013aeb9a082e18d870f69e
Opcode Fuzzy Hash: 3751498352f040cba19f009d69716c5bf58430d39e6dfa8ee8256390bb52f14e
Instruction Fuzzy Hash: 77F0153190464EDBCF129F64C800AD9B771FF89300F008685E50937250DB70AB99DF40

Uniqueness

Uniqueness Score: -1.00%

Function 027B3ED0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066258bbee73924b6a169be1b539363bf96dcc927d27268b7c4fc2c79ac811f6
Instruction ID: ba8f9ec293b5821d43e0d8ee72452081157bfb6625d4f4ce9f8b0e02ecf79865
Opcode Fuzzy Hash: 066258bbee73924b6a169be1b539363bf96dcc927d27268b7c4fc2c79ac811f6
Instruction Fuzzy Hash: D5E01238909108DFC744DF98E9416ADBBB4EF45314F2095DDD80827351CB325E86DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0605C850 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5074b9653b53b4d6bbb6d669cf66c5d0252c571242a32d7586698b995c137060
Instruction ID: fc9f7c86a9086ddde6146b3d2ac508105e94f058c2b9311bedac81831eda343b
Opcode Fuzzy Hash: 5074b9653b53b4d6bbb6d669cf66c5d0252c571242a32d7586698b995c137060
Instruction Fuzzy Hash: 58E0EC34D49208DBD744DB98E9416BDBBB4EB45714F20919D9C0917351CA715E82DB82

Uniqueness

Uniqueness Score: -1.00%

Function 027B4840 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ea494a663f0d56ba4312efbc41546f3be053dd2c2ef79ee4d25c92e13f1ace
Instruction ID: 98d04cbb325d0466d4d044520dc77fd28ba6658b62ceea0cbecf49a9dd1b7767
Opcode Fuzzy Hash: 47ea494a663f0d56ba4312efbc41546f3be053dd2c2ef79ee4d25c92e13f1ace
Instruction Fuzzy Hash: 2CD0127058B1CCDFCF45DBACE822BFE7BACDB02215F50649DA81823261DB711E50E655

Uniqueness

Uniqueness Score: -1.00%

Function 027B050E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2818774984.00000000027B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27b0000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e725a5f23fa23fbac6b187bfc16e8ee28fce57d3b2260a0f8f89a81baa4d7ed5
Instruction ID: 7aaae14f4769d92cd38146cea4091fe61f8eb1aac594262f69d9875f67a6021c
Opcode Fuzzy Hash: e725a5f23fa23fbac6b187bfc16e8ee28fce57d3b2260a0f8f89a81baa4d7ed5
Instruction Fuzzy Hash: 6EE0E276A08208DFDF169F90CC90B9E7B76EB49310F008194B6896B254CB718AC4DF41

Uniqueness

Uniqueness Score: -1.00%

Function 0605CC58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e90f6068e839ef4df8b2a6857f922d34520ca838c27dc299e5e7c270db6d11f
Instruction ID: ec0b7d7e07f2c360f419c7ac26e25320341faff9650b58a66373ac7a571933dc
Opcode Fuzzy Hash: 7e90f6068e839ef4df8b2a6857f922d34520ca838c27dc299e5e7c270db6d11f
Instruction Fuzzy Hash: D4C08C200DAB048AE280128C658837A3EECA306B02F412C04F90C400208BA200C4EA81

Uniqueness

Uniqueness Score: -1.00%

Function 0605FF10 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3064603364.0000000006040000.00000040.00000800.00020000.00000000.sdmp, Offset: 06040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6040000_payment_invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report payment_invoice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\notepad.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payment_invoice.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Ahaqlwdjt.tmpdb

C:\Users\user\AppData\Local\Temp\Ajeqbh.tmpdb

C:\Users\user\AppData\Local\Temp\Bfbbbybxdyd.tmpdb

C:\Users\user\AppData\Local\Temp\Bicfm.tmpdb

C:\Users\user\AppData\Local\Temp\Bwsqsvl.tmpdb

C:\Users\user\AppData\Local\Temp\Cjvwjs.tmpdb

C:\Users\user\AppData\Local\Temp\Cyjei.tmpdb

C:\Users\user\AppData\Local\Temp\Dkmtdj.tmpdb

C:\Users\user\AppData\Local\Temp\Edgqvqch.tmpdb

Windows Analysis Report
payment_invoice.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre